| Threat Actor | Motivation | Potential Attack Vectors | Possible Impact |
|---|---|---|---|
| Cybercriminals | Financial gain | - Phishing emails - Ransomware - SQL injection - Stolen credentials |
- Data breach - Financial loss - Reputation damage |
| Nation-state actors | Intelligence gathering, Economic espionage |
- Advanced Persistent Threats (APTs) - Zero-day exploits - Social engineering |
- Intellectual property theft - Competitive disadvantage - National security implications |
| Insiders | Revenge, Financial gain | - Data exfiltration - Sabotage - Unauthorized access |
- Data leakage - Operational disruption - Compliance violations |
| Hacktivists | Ideological, Political | - DDoS attacks - Website defacement - Doxing |
- Service interruption - Reputational damage - Public relations crisis |
| Competitors | Competitive advantage | - Corporate espionage - Insider recruitment - Data theft |
- Loss of market share - Compromised strategies - Intellectual property loss |
| Organized crime | Financial gain, Drug trafficking |
- Identity theft schemes - Insurance fraud - Prescription data theft |
- Financial losses - Legal liabilities - Regulatory scrutiny |
| Opportunistic hackers | Curiosity, Skill testing | - Vulnerability scanning - Brute force attacks - Exploiting misconfigurations |
- System breaches - Data exposure - Reputational damage |
| Third-party risks | Various (depends on third party) | - Supply chain attacks - API vulnerabilities - Shared infrastructure exploits |
- Data breaches - Service disruptions - Compliance violations |
| Social engineers | Financial gain, Information gathering |
- Phishing - Pretexting - Baiting |
- Credential compromise - Data theft - Financial fraud |
| Terrorist organizations | Disruption, Panic | - Critical infrastructure attacks - Data manipulation - Insider placement |
- Loss of life - Massive service disruption - Public panic |