Threat actor

What the term covers

NIST's glossary gives several wordings. One defines a threat actor as "an individual or a group posing a threat" (NIST SP 800-150). Another describes the source of risk that can result in harmful impact (NIST SP 800-221). The common thread is a party with the intent and the capability to cause harm.

The term is deliberately broad. A ransomware crew, a lone fraudster, a state-sponsored team and a disgruntled employee are all threat actors. What separates them is motive, skill and resources, not the label.

How threat actors are grouped

Analysts usually describe an actor by three things: what they want, how they work and who they target.

• Motive: money, espionage, disruption, ideology or personal grievance.
• Method: phishing, stolen credentials, exploiting software flaws, or fraud that relies on persuasion.
• Target: a sector, a country, a type of company, or a named person.

Groups are also tracked under names given by vendors and agencies, and the same group can carry several names. Treat any single name as one organization's label, not a universal identifier.

How threat actors show up in executive exposure

Executives attract specific attention because their accounts and identities carry authority. A fraudster who wants a wire transfer, an extortionist who wants a lever, and a harasser who wants a home address all start by collecting facts about a person. Much of that material comes from earlier breaches and from public sources.

Stolen records circulate between actors. One party breaches a service, another buys or receives the records, and a third uses them weeks later. This is why a leaked credential can be used by someone who had nothing to do with the original breach. Stolen data markets explains how records move along that chain.

Reducing the risk

Defenders cannot choose their adversary, so the practical work is to remove easy paths. Use unique passwords and multi-factor authentication on executive accounts. Limit what is published about leadership. Agree a payment verification routine that does not depend on who sounds convincing on a call. Learn which of your executives' records already appear in breach and leak data, so you know what an actor could start with. Executive digital exposure describes that picture.

How it differs from related terms

A threat actor is a party. An initial access broker is one specific kind of actor that sells entry into networks. Malware such as an infostealer is a tool that an actor uses. A vulnerability is a weakness an actor can exploit. Keeping these apart helps a report answer who is behind an attack, not only which tool was used.