The Threat Landscape — Who Attacks, and Why

"Hacker" is often imagined as one kind of person with one motive. In reality attackers fall into a few distinct categories, each with a different goal — knowing which is behind a given threat helps make sense of why it happens and what it's actually after.

By far the most common category, and the one every lesson in this course mainly defends against. Motive: profit. Stolen card numbers, ransomware payments, resold account access, and drained bank accounts are all straightforwardly monetized — this is a business to the people running it, run at scale with automated tools.

Attackers motivated by a political or social cause rather than money — defacing a website, leaking documents, or disrupting a service to make a statement or protest an organization's actions. Individuals are rarely the target here; the target is usually a company, government, or public figure.

Someone with legitimate access — an employee, a contractor, a family member with a shared password — misusing it, whether out of malice, carelessness, or being socially engineered themselves. Insider incidents are undercounted precisely because the access was never technically "broken into."

Well-funded, patient groups operating on behalf of a government, typically after espionage, infrastructure disruption, or intelligence — not a typical target for an individual, but the source of many of the vulnerabilities and techniques that eventually trickle down into the automated tools cybercriminals use against everyone else.