How We Classify Threat Actors: The Three Attributes
Before you memorize actor types, learn the yardsticks used to compare them. SY0-701 gives you exactly three: internal vs. external (does the actor already have legitimate access?), resources/funding (a teenager with a laptop vs. a government budget), and level of sophistication/capability (running downloaded scripts vs. writing custom zero-day exploits). Every exam question about actors is really asking you to place someone on these three scales.
Internal threat actor — Someone who already operates inside the organization's trust boundary — an employee, contractor, or partner with legitimate credentials. They do not need to break in, which is exactly what makes them dangerous.
External threat actor — Someone outside the organization who must first gain access — through phishing, exploits, stolen credentials, or supply chain compromise — before they can do damage.
| Attribute | Low end | High end |
|---|---|---|
| Resources/funding | Unskilled attacker using free tools | Nation-state with salaried teams and custom tooling |
| Sophistication/capability | Runs pre-built scripts without understanding them | Develops zero-days, evades detection for months |
| Location | Internal (already trusted) | External (must breach the perimeter) |
Exam tip: On the exam, when a question asks "which threat actor is MOST likely," work backwards from clues about funding, skill, and access. A months-long stealthy campaign against a defense contractor screams nation-state; a defaced website with a political slogan screams hacktivist.
These attributes are not academic — they drive real defensive decisions. A hospital that concludes its most likely adversaries are ransomware crews (external, well-funded, moderately sophisticated) will invest in email filtering, backups, and rapid patching. A defense contractor expecting nation-state espionage adds network segmentation, egress monitoring, and threat hunting, because its adversary will get in eventually and must be found. Threat modeling starts by asking who would attack you, and these three attributes are the vocabulary for the answer.
Don't confuse: Do not confuse internal vs. external with malicious vs. accidental. An internal actor can be entirely well-meaning (an employee who misdirects an email full of PII), and an external actor can be authorized (a contracted penetration tester). Location describes access, not intent — the exam tests these as independent dimensions.
An intrusion used custom-built malware, remained undetected for eleven months, and targeted a defense contractor's research files. Which attribute profile best fits the actor?
Which threat actor attribute most directly determines whether the attacker must first defeat perimeter defenses before doing damage?