Security+ Domain 2: Threats, Vulnerabilities & Mitigations

Security+ frames threat actors along three attributes: whether they operate from inside or outside the organization, how much funding and resources they command, and their level of sophistication and capability. Those three dials, plus a motivation, define each of the six named actor types. Get comfortable placing any scenario on those dials — exam questions describe behavior and ask you to name the actor, or name the actor and ask you to predict the behavior.

The six threat actor types

A nation-state actor is a government (or a group sponsored and directed by one) conducting cyber operations for national objectives: espionage, sabotage of critical infrastructure, intellectual-property theft, or preparation for war. Nation-states are the best-funded and most sophisticated actors on the list, and they are the classic operators of the advanced persistent threat (APT) — a long-duration, stealthy campaign that maintains footholds in a target network for months or years. A hallmark of nation-state tradecraft is patience: custom malware, zero-day exploits, and a willingness to wait for the perfect moment rather than smash-and-grab.

An unskilled attacker (often called a script kiddie) sits at the opposite end. They lack the ability to write their own exploits, so they run pre-built tools and scripts downloaded from the internet against whatever targets those tools happen to work on. Their motivations skew toward curiosity, bragging rights, and chaos. Don't dismiss them — an unskilled attacker running a powerful public exploit against an unpatched server does exactly as much damage as an expert would.

A hacktivist attacks in service of a philosophical or political belief — protest by packet. Typical operations are website defacement, DDoS against organizations they oppose, and leaking documents to embarrass a target. Funding is usually low to moderate; sophistication varies widely because loosely organized collectives (Anonymous is the textbook example) contain both experts and amateurs.

An insider threat is anyone with legitimate access — employee, contractor, business partner — who uses that access to harm the organization, whether deliberately (revenge, financial gain, coercion) or accidentally (negligence). Insiders are dangerous out of proportion to their skill because they start behind the perimeter defenses: they don't need to break in, they're already in. That also makes them the hardest actor to detect.

Organized crime is cybercrime run as a business: hierarchical groups with specialists (initial access brokers, malware developers, money launderers) pursuing financial gain at scale. Ransomware-as-a-service operations, large phishing campaigns, payment-card theft, and BEC fraud are their staples. Funding and sophistication are high — sometimes rivaling nation-states — but the motive is almost always money, which makes their behavior predictable: they go where the payout is.

Shadow IT is the odd one out: not a villain, but a threat source. It's the use of unsanctioned hardware, software, or cloud services by well-meaning employees — a department spinning up its own file-sharing account, a developer wiring up an unapproved SaaS tool. Because these systems bypass the security team entirely, they're unpatched, unmonitored, and unconfigured — an attack surface the organization doesn't even know it has.