[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.3.a
AP Cybersecurity · Introduction to Security
Identifying the Type of Adversary
Two axes: what they can build, and why they came here.
key ideaClassify on two axes: what they can build and why they are here.
The categories
Adversary type is not a personality label. It is a working estimate of capability and intent — and those two together predict what an attacker will attempt next, which is the only reason the classification is useful.
Skill sets the ceiling on what is possible; motivation sets the target and how long the adversary will persist. Neither axis alone predicts behavior. | Low-skilled adversary | High-skilled adversary |
|---|
| tools | purchased or downloaded, built by others | written or modified in-house |
| vulnerabilities used | known ones, already published | also undocumented ones — zero days |
| response to defenses | moves to an easier target | adapts the tool and tries again |
| patching helps? | yes — usually decisive | helps, but does not close a zero day |
| typical persistence | opportunistic, short | sustained, patient |
The pivotal row is the fourth. Patching removes almost everything a low-skilled adversary can do — and is exactly why it is the highest-value routine control.
| Motivation | What it looks like in practice | Likely target |
|---|
| greed | ransomware, fraud, selling stolen data | whoever will pay |
| recognition | defacement, boasting, public leaks | high-visibility victims |
| dedication to a cause | disruption aimed at an issue | organizations tied to that issue |
| revenge | insider abuse, targeted leaks | a specific former employer or person |
| politics or belief | espionage, long-term intrusion | governments, infrastructure, suppliers |
Motivation answers ‘why us’. An organization with nothing an attacker wants financially may still be a target for the access it provides to someone else.
Telling them apart
the two questions
- Ask first: did the attack use a known vulnerability or an undocumented one?
- Ask second: did the adversary adapt when blocked, or move on?
- A zero day is strong evidence of high skill — it cannot be bought off the shelf.
- Motivation is inferred from the target and the payload, not from the tooling.
Worked examples
EX 1
Classify from the evidence
An attacker exploits a vulnerability patched 14 months ago, using a tool sold on a forum. When blocked, they stop and move to another organization. Classify them.
1
Check the vulnerability
Known and patched — no original research involved.
2
Check the tooling
Purchased, not written.
3
Check the reaction to defense
They left rather than adapting.
4
Classify the skill
Low-skilled on all three signals.
5
Draw the defensive conclusion
Patching would have prevented this entirely — the whole attack depended on an unpatched flaw.
EX 2
The adversary who adapts
An intrusion uses a flaw with no vendor advisory. After the team blocks one path, a modified variant appears within days. Classify them.
1
Check the vulnerability
Undocumented — a zero day, which cannot be purchased ready-made.
2
Check the response to blocking
A modified tool appeared, so the adversary can rewrite their own code.
3
Classify the skill
High-skilled on both signals.
4
Adjust expectations
Patching alone will not settle this. Detection, segmentation and monitoring become the load-bearing controls.
5
Note the persistence
Expect repeated attempts. High-skilled adversaries return.
EX 3
Skill and motivation disagree
A former employee with no technical background uses credentials they still remember to delete records. Classify them on both axes.
1
Assess the skill
Low — no tools, no vulnerabilities, no code.
2
Assess the motivation
Revenge — targeted at one specific organization.
3
Note the mismatch
Low skill, but high knowledge of the target — where records are and what matters.
4
Identify the failing control
Offboarding: the account should have been disabled on departure.
5
Draw the lesson
Skill is not the only thing that makes an adversary dangerous. Access and knowledge substitute for it.
Watch out
“Low-skilled” does not mean harmless
A purchased tool exploiting a known flaw still encrypts your files. It means the attack was preventable by patching, not that it was minor.
A zero day is the strongest skill signal
Undocumented vulnerabilities cannot be bought ready-made. Their use implies research capability, which changes what defenses you should rely on.
Do not infer motivation from tooling
Anyone can buy ransomware. The choice of target and what was taken is what indicates why.
Insiders bend the model
Low technical skill combined with legitimate access and inside knowledge can outperform a skilled outsider. Offboarding is the control that closes it.