In basic threat profiling we look at their level of sophistication and behaviour to classify: Script kiddy / amateur level - runs loud port scans, basic metasploit modules, easily detected, phishing is low quality, gives up on a target when no easy exploitation is available, probably won't know how to pivot if they did get successful access Fincrime / organized crime group - often has extensive infrastructure, hard but not impossible to track, looks for targets of opportunity but may focus on a target. Primarily looks for account compromise (to sell), ransomware delivery or BEC -> invoice fraud kind of attacks. Motivated by profit which drives their targeting (big orgs, critical orgs that are likely to pay). Will usually use latest exploits with flexible degree of customization, or custom tools Nation-state - very sophisticated. Will focus on targets and will stay on target until they achieve infiltration. Hard to track (but not impossible - look up IntrusionTruth for some nation state level doxxing). Uses a mix of well-known and custom tools, however custom tools are rarely and carefully deployed. Phishing is high level and can be quite effective You also have hacktivists which I generally classify somewhere between script kiddy and fincrime levels of sophistication. More on reddit.com

I think you over-estimate how good (most) attackers are. A lot of them are really just phishing or exploiting unpatched software. More on reddit.com

I recommend this: http://www.catb.org/~esr/faqs/hacker-howto.html That's also listed in DEFCON's reading list. I assume you know DEFCON. More on reddit.com

Nothing like the movies. Most of it is writing a program at your leisure, depending on what you’re doing. It’s just exploiting over sights or weaknesses in a code or system. Very little is done in real time, and even that is more more mundane, just exploring directories for data you want, etc. More on reddit.com