COMP 6660 · Enterprise Cybersecurity Enterprise Threat Landscape

00 Introduction

Lesson 1.2 established what is protected. Lesson 1.3 established what "protecting" means. This lesson establishes who is doing the attacking — and why.

Enterprise security programmes are sometimes designed against an abstract adversary: "the attacker" or "the threat" — a generic figure who exploits vulnerabilities, exfiltrates data, and can be deterred by sufficiently rigorous controls. In reality, adversaries differ profoundly in motivation, capability, patience, and acceptable cost. A ransomware operator attacking an SME in pursuit of payment is not the same adversary as a nation-state intelligence service seeking long-term access to a defence contractor. They use different techniques, target different assets, and are deterred by different controls.

This lesson develops the vocabulary of threat actor analysis. It examines four principal categories — cybercriminals, nation-state actors, hacktivists, and insiders — and the motivations that shape how each operates. It introduces a framework for reasoning about adversaries in terms of capability, intent, and persistence, and shows how that framework should shape defensive priorities. It closes with the trends currently reshaping the landscape, several of which are examined in depth in Unit 3 of Module 2.

The material here is introductory. It gives you the vocabulary and the analytical framework. Module 2, Unit 3 develops the threat landscape in detail: threat modelling methodologies (Lesson 3.2), vulnerability assessment (Lesson 3.3), and specific attack classes — ransomware (3.4), social engineering (3.5), advanced persistent threats (3.6), and insider and supply-chain risk (3.7).

01 Learning objectives

By the end of this lesson you should be able to:

These objectives contribute to Unit 1 outcomes U1.3 (cybersecurity risk) and U1.5 (posture assessment), and to Module 1 outcomes M1.3, M1.6, and M1.8. See the Unit 1 learning outcomes page for the full mapping.

02 Why threat actor analysis matters

Threat actor analysis is the practice of reasoning about adversaries as distinct entities with identifiable characteristics — rather than as a generic threat. It matters because defences are not equally effective against all adversaries, and resources are finite.

Capability, intent, and persistence

Threat actors are usefully described along three dimensions. The framework is not the only one in use, but it captures the distinctions that matter most for defensive planning.

A fourth dimension — acceptable cost — is often folded into persistence. It is the amount of effort, time, and risk the adversary is willing to spend to achieve its objective. A financially motivated actor stops when the return no longer justifies the investment. A state-sponsored actor may continue for years.

03 Cybercrime

How cybercrime operates

Cybercrime is a business, and it is organised accordingly. Successful criminal operations specialise: some develop and sell malware, some operate infection infrastructure, some handle credential markets, some run the monetisation and money-laundering side. The result is an ecosystem in which individual actors do not need to be capable of the full attack lifecycle — they can buy the components they lack.

This specialisation is the most important development in cybercrime over the past decade. Ransomware-as-a-service, phishing kits, credential markets, and initial-access brokers all exist because the division of labour that made legitimate industries efficient also works for criminal ones. The barrier to entry for a would-be criminal has fallen dramatically.

Principal cybercrime business models

Characteristics of cybercrime

• Financially motivated. The objective is money, directly or indirectly. This shapes behaviour: criminal actors generally prefer techniques that scale and avoid engagements that cost more than they return.
• Opportunistic and targeted. Some campaigns are indiscriminate, scanning for any vulnerable target; others are carefully targeted at enterprises known to be able to pay. Many combine both — opportunistic initial access followed by targeted selection of which victims to extort.
• Organised and specialised. Successful operations are run as businesses, with division of labour, project management, and customer service. Ransom negotiation is often handled by dedicated staff.
• Cost-sensitive. Criminal actors typically weigh the expected return against the effort and risk of detection. Defences that increase the cost of attack — segmentation, hardened backups, rapid detection — often cause attackers to move to easier targets.
• Increasingly destructive. The shift from encryption-only to encryption plus exfiltration has increased the leverage attackers hold over victims, and the harm from refusal to pay.

Defensive priorities against cybercrime

Defences against financially motivated actors prioritise the controls that increase the cost of attack or reduce its return:

• Identity and access hygiene. Multi-factor authentication, privileged access management, and prompt de-provisioning of terminated accounts reduce the value of stolen credentials.
• Segmentation. Limits the scope of any single compromise and makes lateral movement more expensive.
• Tested, offline backups. Reduces the leverage of ransomware by restoring the enterprise's ability to recover without payment.
• Rapid detection and response. Shortens dwell time and disrupts campaigns before they reach their objective.
• Email and web security. Reduces the effectiveness of the most common initial-access vectors.
• Cyber insurance and financial controls. Manages the residual financial exposure and makes fraudulent payment harder.

04 Nation-state actors

What distinguishes nation-state actors

Nation-state actors differ from other threat categories in ways that matter for defence:

• Resources. State sponsorship provides funding, personnel, time, and access to intelligence capabilities that no criminal group can match. This includes zero-day vulnerabilities, custom malware development, and sustained operational infrastructure.
• Patience. State actors measure success over years, not weeks. Long-dwell campaigns in which the adversary maintains quiet access for extended periods are characteristic, and the value of the access may only be realised long after the intrusion.
• Stealth over disruption. Because persistent access is valuable, state actors typically favour quiet operation over visible impact. They will avoid techniques that attract attention and will abandon or delay an operation if it risks exposure.
• Strategic targeting. Nation-state targeting is driven by strategic interest: defence, government, critical infrastructure, research institutions, technology companies, think tanks, and — increasingly — suppliers and partners of those organisations.
• Geopolitical context. Attribution and response are complicated by geopolitical considerations. Public attribution of a state-sponsored attack is a policy decision, not just a technical one.

Motivations

Who is at risk

Most enterprises assume nation-state actors are not relevant to them. That assumption is frequently wrong. State-sponsored activity reaches well beyond government and defence into:

• Critical infrastructure operators — energy, water, transport, communications, healthcare.
• Technology and telecommunications firms — both as targets in themselves and as paths to their customers.
• Research institutions and universities — a primary target for intellectual property collection.
• Defence contractors and their supply chains — including smaller suppliers who often have weaker controls than the prime contractor.
• Think tanks, NGOs, and media — for intelligence and influence purposes.
• Enterprises with strategic technologies — semiconductors, artificial intelligence, biotechnology, quantum, advanced manufacturing.

Defensive priorities against nation-state actors

Defences against nation-state actors differ from those against cybercrime. Criminal actors can often be deterred by increasing cost; state actors generally cannot, because cost is not the constraint. The defensive priorities shift accordingly:

• Detection over prevention. Preventing a well-resourced adversary from ever obtaining access is not realistic. Detecting the intrusion early, and limiting how far it can spread, is achievable.
• Assume breach. Design architectures and controls on the assumption that some initial access will succeed, and focus on containment, lateral movement detection, and data exfiltration detection.
• Identity hardening. State actors target identity systems because control of identity provides access to everything else. Privileged access management and strong authentication are essential.
• Supply-chain assurance. Nation-state activity frequently targets the suppliers of a principal target. Supply-chain risk management matters even for organisations that do not consider themselves primary targets.
• Threat intelligence. Understanding the specific adversaries that target the enterprise's sector or region allows defences to be tuned to the techniques those adversaries actually use.
• Collaboration with authorities. National cyber-security agencies frequently have intelligence that enterprises do not, and can advise on specific threats.

05 Hacktivism

Characteristics of hacktivist activity

• Ideologically motivated. The objective is to advance a cause, punish a perceived wrong, or gain attention. Financial return is rarely the purpose, though some actors monetise opportunistically.
• Publicity-oriented. Hacktivist operations are designed to be noticed. Data leaks, website defacement, and denial-of-service attacks all generate attention, which is often the point.
• Targeted at symbols. Targets are chosen for their symbolic value or their perceived connection to the cause — governments, corporations, political organisations, and increasingly enterprises associated with contested issues.
• Variable capability. The category ranges from low-capability actors using off-the-shelf tools to sophisticated groups capable of significant disruption. The distribution is heavily weighted toward the lower end, but the impact of a single high-capability campaign can be substantial.
• Often transient. Hacktivist campaigns tend to be episodic — triggered by events, sustained for a period, then declining. This distinguishes them from the sustained campaigns of state actors.

Common hacktivist techniques

Why hacktivism matters even at low capability

Hacktivist activity is sometimes dismissed as low-risk because the actors are often less capable than cybercriminals or state actors. This dismissal is short-sighted. Three considerations make hacktivism relevant to enterprise security:

• Reputational damage can be disproportionate. A leaked document or a defaced website can generate more damage in a day than a technically more sophisticated intrusion would in a year.
• Availability attacks are easy and cheap. DDoS services are widely available and inexpensive. Even low-capability actors can mount disruptive campaigns.
• Targeting can be arbitrary. Enterprises with no obvious connection to a contested issue may find themselves targeted because of a perceived association, a customer relationship, or simply because they are visible.

Defensive priorities against hacktivism

• Availability controls. DDoS mitigation, content delivery networks, and rapid failover reduce the impact of availability attacks.
• Reputation and communications readiness. A pre-prepared crisis communications plan allows the enterprise to respond quickly when targeted.
• Data-loss prevention and monitoring. Detecting and limiting exfiltration reduces the impact of leaks.
• Monitoring for targeting signals. Hacktivist campaigns typically announce themselves — through social media, dedicated channels, or press releases. Early warning allows preparation.
• Public web and social account security. Protect public assets — websites, social accounts, public email — with strong authentication and monitoring.

06 Insider threats

Three types of insider

The term "insider threat" covers three distinct phenomena. Confusing them leads to poorly designed controls.

Why insiders are disproportionately damaging

• They bypass perimeter controls. Insiders have legitimate access, so controls designed to keep outsiders out do not apply.
• They know what is valuable. Insiders understand which data matters, where it lives, and how it is protected — knowledge that external attackers must acquire over time.
• Their activity looks legitimate. An insider accessing systems during working hours is not anomalous. Detection requires behavioural baselines and careful analysis.
• They may act over extended periods. Malicious insiders can sustain activity for months or years without detection, particularly when the volume of activity is small and consistent with their role.
• Post-incident attribution is difficult. Determining what was taken, when, and by whom can be impossible without comprehensive logging and clear identity attribution.

Risk factors for malicious insider activity

Insider risk is not random. Certain circumstances increase the likelihood of malicious activity:

• Disgruntlement. Employees who feel unfairly treated, overlooked for promotion, or subject to perceived injustice.
• Resignation or termination. Departing employees — particularly those leaving involuntarily — are a heightened-risk group, especially in the period before departure is announced.
• Financial pressure. Personal financial stress increases susceptibility to bribery or opportunistic theft.
• Ideological alignment. Employees who sympathise with a cause opposed to their employer's activities.
• Coercion. Employees targeted by external actors — through blackmail, threats, or manipulation.
• Excessive privilege. Access beyond what is necessary for the role expands both the opportunity and the potential harm.

Defensive priorities against insider threats

• Least privilege. Reduce access to the minimum required for each role, and review access regularly — particularly when responsibilities change.
• Separation of duties. Ensure that no single individual can complete a sensitive action alone.
• Monitoring and analytics. User and entity behaviour analytics, data-loss prevention, and access anomaly detection.
• Exit processes. Prompt de-provisioning of access on departure or role change, with particular attention to privileged accounts and access to sensitive data.
• Culture and awareness. A workplace in which employees feel valued and in which concerns can be raised without fear reduces insider risk more effectively than surveillance.
• Legal and contractual controls. Confidentiality agreements, acceptable-use policies, and clear consequences for violation.
• Insider risk programme. Formal programmes that bring together HR, security, legal, and management to identify and mitigate insider risk in a coordinated way.

07 Comparing threat actors

The four categories introduced above differ across several dimensions. The table below summarises the principal differences. It is a simplification — real actors sometimes blur categories, and proxy relationships complicate the picture — but it captures the distinctions that matter for defensive planning.

Blurring and overlap

The categories are analytically useful, but their boundaries are not rigid:

• State-criminal collaboration. States sometimes use criminal groups as proxies, providing capability in exchange for plausible deniability. The result is an actor that behaves like a criminal group but pursues state objectives.
• Hacktivist-to-criminal transition. Some hacktivist groups monetise their activity, blurring the line with cybercrime.
• Insiders as initial access. Insider access can be sold, provided, or coerced — so what begins as an insider issue becomes an external campaign.
• Compromised insiders. The "compromised insider" category is, in effect, an external actor operating under insider cover — and can belong to any of the other categories.

Because boundaries are blurred, defensive planning should not assume that a given incident belongs to exactly one category. The useful question is not "which category is this?", but "what does this adversary want, what can it do, and how long will it persist?" — the three dimensions introduced in Section 1.

08 How the threat landscape is changing

The threat landscape is not static. Several trends are reshaping who attacks enterprises, how, and with what consequences.

Trends shaping the modern landscape

1. Industrialisation of cybercrime Specialisation, service models, and marketplaces have lowered the barrier to entry and increased the volume of attacks. Ransomware-as-a-service, initial access brokerage, and phishing kits are now widely available.
2. Escalation from data to operations Attacks increasingly target availability and safety, not just confidentiality. Ransomware, denial-of-service, and attacks on operational technology have moved the consequences of attack closer to physical disruption.
3. Supply-chain as the attack path of choice Rather than attacking a well-defended target directly, adversaries target its suppliers, software dependencies, and service providers — reaching many victims through one compromise.
4. Convergence of state and criminal activity States sponsor, use, or tolerate criminal actors as proxies; criminal actors sell access to states. The distinction is becoming less useful in practice.
5. AI as both tool and target AI is being used to scale reconnaissance, phishing, and voice impersonation; and AI systems themselves are increasingly targeted for their models, training data, and access. The governance implications are examined in Module 3, Lesson 6.10.
6. Regulatory escalation Regulators are increasingly prescriptive about security outcomes and breach notification, with personal liability for executives emerging in several jurisdictions. The compliance landscape is examined in Module 3, Lesson 6.4.
7. Growing acceptance of "assume breach" Defensive thinking has shifted from trying to prevent all intrusions to detecting and containing those that succeed. This is the conceptual foundation of Zero Trust (Module 1, Lesson 2.7) and of modern detection and response.

What these trends imply for enterprises

• Defences must assume eventual compromise. Prevention alone is insufficient against adversaries who are patient and well-resourced. Detection, containment, and recovery are as important as prevention.
• Third-party risk is enterprise risk. The enterprise's security posture is partly determined by the security of its suppliers, dependencies, and service providers — which it cannot directly control.
• Availability deserves equal priority. The shift from data to operations means availability controls — redundancy, backups, DDoS mitigation, resilience — are central to enterprise security, not peripheral.
• Regulatory and reputational consequences are rising. The cost of a breach now includes legal liability, regulatory sanction, executive accountability, and long-term reputational damage.
• Threat intelligence is increasingly necessary. Understanding the specific actors targeting the enterprise's sector or region allows defences to be tuned to the techniques those actors use.

09 Applying threat actor analysis

Threat actor analysis is only useful when it changes decisions. This section shows how to apply it — first to an enterprise, then to a specific asset.

Step 1 — Identify plausible adversaries

For the enterprise as a whole, ask: which adversaries have both the intent and the opportunity to target us? Intent is a function of what the enterprise does, what it holds, and who it serves. Opportunity is a function of its exposure and its perceived defensibility.

Step 2 — Map adversaries to assets

Different adversaries target different assets. Mapping the two clarifies where defensive investment is best directed.

Step 3 — Select defences that address the mapping

Defensive investment should reflect the adversary-asset mapping. Three principles follow.

• Prioritise the assets that multiple adversaries target. Identity services, customer data, and critical operational systems are attractive to several categories at once; they warrant the strongest controls.
• Prioritise adversaries that cannot be deterred by cost. Nation-state activity and insider action are not deterred by hardening alone; they require detection, containment, and resilience.
• Recognise the limits of any single control. Controls that defeat one adversary may not defeat another. Layered defence — the subject of Lesson 1.5 — is what allows a single control architecture to address a diverse threat landscape.

10 Key concepts

The terms below are used throughout the course. Capture them in your own words as you work through the lesson.

Threat actor

An individual or group that poses a threat to enterprise assets. Principal categories include cybercriminals, nation-state actors, hacktivists, and insiders.

Threat landscape

The overall picture of adversaries, techniques, and trends that an enterprise faces at a given point in time. A moving target, not a fixed inventory.

Cybercrime

Financially motivated criminal activity conducted through or against digital systems. Increasingly organised, specialised, and industrialised.

Ransomware-as-a-service (RaaS)

A criminal business model in which malware developers license their tooling to affiliates in exchange for a share of the proceeds. Lowers the technical barrier to launching ransomware attacks.

Initial access broker

A criminal specialist who acquires access to enterprise networks and sells it to other criminals who conduct the primary attack. A form of criminal specialisation.

Nation-state actor

A group associated with, sponsored by, or directed by a state government. Pursues objectives connected to national interest: intelligence, strategic advantage, and sometimes disruption.

Advanced persistent threat (APT)

A long-dwell, well-resourced campaign that seeks persistent access rather than immediate disruption. Typically associated with nation-state activity, though some criminal groups also operate in this mode.

Hacktivism

The use of digital attack techniques to pursue ideological, political, or social objectives — typically through disruption, exposure, or embarrassment.

Insider threat

Risk arising from individuals with legitimate access to enterprise systems, data, or facilities. Distinguished into three types — malicious, negligent, and compromised — which require different defensive responses.

Malicious insider

An insider who deliberately causes harm through theft, sabotage, fraud, or provision of access to external actors.

Negligent insider

An insider who unintentionally causes harm through carelessness, error, or lack of awareness. The most common form of insider-caused loss.

Compromised insider

An external actor operating through a legitimate account, having stolen credentials or compromised the user's system.

Dwell time

The period between initial compromise and detection. A key metric for detection capability; long dwell times are characteristic of nation-state activity.

Assume breach

A defensive posture that assumes some initial access will succeed, and focuses on detecting, containing, and recovering from intrusions rather than only preventing them. Conceptual foundation of Zero Trust.

Threat intelligence

Information about adversaries, their motivations, capabilities, and techniques, used to inform defensive decisions. Draws on internal telemetry, industry sharing, government advisories, and commercial sources.

11 Activities

The activities below help you test your understanding and prepare for the unit discussion and Assignment 1. They are not graded, but completing them will improve the quality of your forum contribution.

12 Self-check

Answer the questions below before moving to Lesson 1.5. If you cannot answer a question confidently, revisit the corresponding section.

13 Summary

This lesson has introduced the adversary picture. The essential points are:

• Defences are designed against adversaries, not abstractions. Threat actor analysis matters because different adversaries require different defences, resources are finite, incident response depends on attribution, and risk assessment depends on knowing who plausibly targets the enterprise.
• Actors are usefully described in terms of capability, intent, and persistence. A fourth dimension — acceptable cost — captures the amount of effort an adversary is willing to absorb. Cost-sensitive adversaries can be deterred by hardening; patient, well-resourced ones cannot.
• Cybercrime is industrialised. Specialisation, service models, and marketplaces have lowered barriers to entry. Defensive priorities are cost increase, rapid detection, and resilience — particularly tested, offline backups.
• Nation-state actors are patient and strategic. They pursue intelligence, intellectual property, pre-positioning, or disruption over years. Defensive priorities are detection, containment, identity hardening, and supply-chain assurance.
• Hacktivism is variable in capability but disproportionate in reputational impact. Defensive priorities are availability, reputation readiness, and monitoring for targeting signals.
• Insider threats come in three forms. Malicious, negligent, and compromised insiders require different controls. Least privilege, monitoring, culture, and exit processes address the range.
• The landscape is shifting. Industrialisation, escalation from data to operations, supply-chain targeting, state-criminal convergence, AI, regulatory escalation, and the "assume breach" posture are reshaping defensive priorities.

These ideas are developed in depth in Module 2, Unit 3. Lesson 1.5 turns to the frameworks and models that structure enterprise security programmes against this landscape. Lesson 1.6 applies everything so far to documented enterprise breaches.