Threat actors come in stable archetypes — long-lived shapes that outlast specific group names, campaigns, and CVEs. The capability ladder runs from automated opportunists (most of the volume) up to nation-state operators (the smallest set, the most patient). Insiders sit outside the ladder: they're authorized, which is why they don't need any of it.
Minimal — automated scanning, known exploits, reused credentials from public dumps. No targeting; whoever's exposed gets hit.
Anyone with an exposed surface. Mid-market without basic hygiene gets selected for them automatically.
Note · Most attacks worldwide are this — the baseline most orgs need to defend against first.
Moderate — purchased initial access from access brokers, RaaS kits with playbooks. Some targeting (sector preference, size).
Under-resourced mid-market — healthcare systems, school districts, manufacturing, municipalities.
Note · The breach class that makes the news in mid-market. Recovery cost dominates the loss, not data theft.
Variable — defacement, DDoS, document leaks. Sporadic but reputation-damaging.
Politically or reputationally salient organizations — government, energy, controversial brands.
Note · Often spikes around news events. Not the durable threat for most orgs.
Well-resourced — BEC at scale, sophisticated ransomware ops, data theft for resale on dark markets.
Financial gain at scale. Financial services, retail, large enterprise.
Note · Where most named ransomware crews sit. Modern affiliates blur the line into nation-state TTPs.
Top-tier — custom tooling, stealth, espionage, pre-positioning, destructive operations. Patient.
Government, defense industrial base, critical infrastructure, high-value IP holders.
Note · Most orgs are not in this threat model. If you are, you know.
Variable — legitimate access, mishandled or misused. Negligent insiders (most cases) bypass technical controls by being authorized.
From within — wherever the insider has access. Disgruntled departures, third-party contractors with broad permissions, careless privileged users.
Note · Quietly the largest class of incidents by count, dwarfed in headlines by nation-state and ransomware.