Theory: Threat Actors, Attack Vectors & the Defender’s Response
Section 2.2 covered what is attacked (assets) and where it is weak (vulnerabilities). This section covers who attacks and why (threat actors and their motivations), how they get in (attack vectors), and how an organization responds: by monitoring, testing and deciding.
The Threat
A threat is a potential event that involves an existing vulnerability and an exploit, with the intent to compromise security, violate security, or cause harm or loss of cyber-properties.
A threat needs something to act through: a weakness to use and a means of using it. The threat actor is the person, group or entity behind it.
Threat Actor Categories
| Actor | Description |
|---|
| Insider (employee, contractor) | Someone with legitimate access: current or former staff, contractors, vendors |
| External hacker / cybercriminal | An outsider attacking for gain |
| Organized crime group | A structured, well-resourced criminal operation (often running ransomware or fraud as a business) |
| Nation-state actor | Government-backed teams with large resources and long time horizons |
| Hacktivist | Attacks to make an ideological or political statement |
| Script kiddie / opportunist | Low-skill attacker using ready-made tools against whatever is easy |
Motivation Shapes the Threat Actor
Knowing an actor’s motivation helps predict what it will target.
| Actor | Primary motivation | Typical target |
|---|
| Insider | Grievance, financial gain, negligence | Data and systems they already access |
| Cybercriminal | Financial gain | Financial / customer data |
| Nation-state | Espionage, geopolitical advantage | Critical infrastructure, intellectual property |
| Hacktivist | Ideological / political statement | Public-facing systems, reputation |
Two further points complete the picture:
- Organized crime shares the cybercriminal’s financial motive but operates at scale, often with ransomware, extortion and resale of stolen data.
- Script kiddies / opportunists are motivated by curiosity, bragging rights or easy gain. They don’t choose a target for its value; they choose it because it is easy (unpatched, misconfigured, default passwords).
Common mistake: assuming insiders are always malicious. Negligence (misdirected emails, lost laptops, clicking a phishing link) is a major insider motivation. The misdelivered payroll spreadsheet in 2.1 is an insider incident with no malice at all.
Insider threats are often underestimated because they need no “break-in”: the insider already has valid credentials, so perimeter defenses never see an intrusion. Former employees and contractors whose access was never revoked are a classic exam scenario.
Meet the Hacker
Every threat actor needs someone to actually take action: the hacker. The hacker:
- Chooses a target based on what is valuable;
- Looks for the open window, the vulnerability;
- Decides on a path in, the attack vector.
Common Attack Vectors
Attack vector = the path a threat takes to reach the vulnerability.
Common attack vectors, at concept level:
| Attack vector | How it works | Typical vulnerability it uses |
|---|
| Phishing / social engineering | Tricks people into revealing credentials or running malware | Lack of training (human) |
| Malware (via email, download or removable media) | Malicious software delivered to a device | Unpatched systems, user behavior |
| Unpatched or outdated systems | Attacker reaches a known, unfixed flaw directly | Technical |
| Weak or stolen credentials | Logging in “legitimately” with a guessed or stolen password | Weak passwords, no MFA, unrevoked access |
| Physical access to facilities or devices | Walking in, plugging in, taking a device | Physical |
| Third-party / supply chain compromise | Breaking in through a vendor, supplier or service the organization trusts | Weak vendor security, unreviewed integrations |
The Chain Comes Together
Diagram loads as you scroll.
Follow the hacker: target → vulnerability → threat → attack vector → exploit (Act 1). Then switch sides to the defender (Act 2).
The Defender’s Response
1. Monitor & Analyze
How does an organization know it is being watched?
- Watch for signals: repeated failed logins, off-hours data access, unusual traffic patterns.
- Continuously active: detection should happen before damage, not after an incident is reported.
- A managerial question: not “which tool?” but how do resources and process ensure signals are seen, and escalated, in time?
2. Penetration Test
Before the real hacker finds the open window, the organization tests it first:
- Hire testers who think and act like a hacker (authorized, white-hat).
- Deliberately try to find the vulnerability before real attackers do.
- Feed the results back to the team that owns the system, so the window gets closed.
3. The Security Analyst Decides
Someone must decide which window gets fixed first, with limited time and budget:
- not just finding vulnerabilities, but deciding which risks get addressed first;
- making resource-constrained trade-offs.
This decision-making process (which risks to fix, accept or defer under limited resources) is called Risk Assessment, the topic of Week 3.
Diagram loads as you scroll.
Worked Examples
Exercise 1
Identify the most likely threat actor category for each scenario:
(a) A group defaces a pharmaceutical company’s website with a protest message about drug prices.
(b) A teenager uses a free online tool to scan for webcams with default passwords and takes over a few.
(c) A billing clerk copies patients’ insurance numbers to sell them.
(d) A government-backed team spends a year quietly inside a power grid operator’s network.
(e) A gang encrypts a hospital’s servers and demands payment in cryptocurrency.
Show solution ↓Hide solution ↑
Solution
Match each scenario to the motivation and target in the table.
- (a) Political/ideological statement on a public-facing system → Hacktivist.
- (b) Low skill, ready-made tools, easy targets → Script kiddie / opportunist.
- (c) Legitimate access misused for financial gain → Insider.
- (d) Long-term espionage against critical infrastructure → Nation-state actor.
- (e) Financially motivated extortion at scale → Organized crime group (cybercriminals).
(a) Hacktivist, (b) Script kiddie, (c) Insider, (d) Nation-state, (e) Organized crime.
Exercise 2
A former contractor’s VPN account was never disabled. Six months after the contract ended, it is used at 2 a.m. to download engineering drawings. Name the threat actor category, the vulnerability (with its category), and the attack vector.
Show solution ↓Hide solution ↑
Solution
- Threat actor: the person using credentials they were given as a contractor → Insider (a former insider; insiders include contractors).
- Vulnerability: access never revoked when the contract ended → a missing offboarding procedure, Human/Process.
- Attack vector: logging in with valid but stale credentials → weak or stolen credentials (here, unrevoked legitimate credentials over the VPN).
- A defender’s signal that should have triggered an alert: off-hours data access by an account with no current owner.
Insider; Human/Process vulnerability (unrevoked access); attack vector: valid credentials over VPN.
Exercise 3
An attacker cannot break into a retailer directly, so they compromise the software update server of a small company that supplies the retailer’s point-of-sale software. The next update installs malware in every store. Which attack vector is this, and why is it hard for the retailer to defend against?
Show solution ↓Hide solution ↑
Solution
- The attacker reached the retailer through a trusted vendor, not directly → third-party / supply chain compromise.
- It is hard to defend against because:
- the malicious update arrives through a trusted, expected channel, so it is not treated as suspicious;
- the vulnerable system belongs to someone else, outside the retailer’s control and monitoring;
- the retailer’s own defenses may be strong, yet they are bypassed entirely.
- Management response: assess vendor security before and during contracts, limit what vendor software can access, and monitor for unusual behavior even from trusted software.
Third-party / supply chain compromise; hard to defend because the attack arrives through a trusted relationship outside the retailer’s own systems.
Exercise 4
A hospital’s security system logged 400 failed login attempts on a doctor’s account over a weekend, followed by a successful login from an overseas IP address. Nobody noticed until Monday afternoon. Which defender activity failed, and what is the management lesson?
Show solution ↓Hide solution ↑
Solution
- The signals (repeated failed logins, then an unusual-location login) were captured, so the data existed.
- What failed is Monitor & Analyze: the signals were not seen and acted on in time. Detection happened after damage was possible, not before.
- The management lesson is that this is not a tool problem. It is about resources and process: who reviews alerts on weekends, what thresholds trigger escalation, and how quickly a human must respond.
Monitor & Analyze failed; management must ensure (through staffing, escalation rules and process) that signals are seen and escalated in time, not just collected.
Exercise 5
A penetration test finds three weaknesses: (i) default passwords on the guest Wi-Fi router; (ii) the EHR server is missing a critical security patch; (iii) the cafeteria’s digital menu board runs an old operating system. The IT team can fix only one this week. Which should the Security Analyst choose, and what is this decision process called?
Show solution ↓Hide solution ↑
Solution
- Weigh each weakness by the criticality of the asset it exposes and how likely it is to be exploited:
- (ii) The EHR is the hospital’s Critical asset (very high value × very high sensitivity), and a missing critical patch is a known, attractive opening.
- (i) The guest Wi-Fi is Low criticality on its own, though it can be a stepping stone.
- (iii) The menu board holds nothing sensitive and supports no core service.
- Fixing (ii) gives the greatest risk reduction for the effort.
- Choosing which risk to address first with limited time and budget is risk assessment.
Patch the EHR server first; the decision process is called Risk Assessment.