In basic threat profiling we look at their level of sophistication and behaviour to classify: Script kiddy / amateur level - runs loud port scans, basic metasploit modules, easily detected, phishing is low quality, gives up on a target when no easy exploitation is available, probably won't know how to pivot if they did get successful access Fincrime / organized crime group - often has extensive infrastructure, hard but not impossible to track, looks for targets of opportunity but may focus on a target. Primarily looks for account compromise (to sell), ransomware delivery or BEC -> invoice fraud kind of attacks. Motivated by profit which drives their targeting (big orgs, critical orgs that are likely to pay). Will usually use latest exploits with flexible degree of customization, or custom tools Nation-state - very sophisticated. Will focus on targets and will stay on target until they achieve infiltration. Hard to track (but not impossible - look up IntrusionTruth for some nation state level doxxing). Uses a mix of well-known and custom tools, however custom tools are rarely and carefully deployed. Phishing is high level and can be quite effective You also have hacktivists which I generally classify somewhere between script kiddy and fincrime levels of sophistication. Answer from Deleted User on reddit.com