Threat Actors & Attack Vectors

Attack Chain

Evidence: Supplementary

Revision: Available · 3 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Supplementary attack-chain reasoning connects credential theft, access, discovery and escalation; exfiltration and ransomware are distinct possible outcomes, not compulsory stages.

• Attack Chain — Supplementary Study Guide explanation

Recorded evidence

• Supplementary attack-chain reasoning connects credential theft, access, discovery and escalation; exfiltration and ransomware are distinct possible outcomes, not compulsory stages.

• Attack Chain — Supplementary Study Guide explanation · The idea; One connected scenario; Stage 1: Phishing; Stage 2: Credential theft; Stage 3: Remote access; Stage 4: Internal reconnaissance; Stage 5: Privilege escalation; Stage 6: Data exfiltration or ransomware; Breaking the chain; Key takeaway; Further reading

Reviewed 2026-09-23. Reviewed against approved Sessions 1–2 and Study Buddy Core Concepts. Scenarios are fictional educational applications, not completed practical work. This concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Attack Surfaces and Attack Vectors

Evidence: Mixed

Revision: Available · 9 questions · 3 flashcards

Exam relevance

• Security+ · 2.2 · direct

  Mapped on 8 October 2026 for threat vectors and attack surfaces in part, including the supply chain. Image-based, file-based and Bluetooth vectors are not yet taught. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 2 of 9 questions and 2 of 3 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 8): attack surfaces and attack vectors were covered, including network vectors, message-based vectors by email, SMS, instant messaging, web and social media and voice calls, and the supply chain as an attack surface.
• Classroom (Session 8): Stuxnet was shown in a video as an example of a sophisticated attack against industrial systems.
• Supplementary: the attack surface is the total set of points where an attacker could interact with or try to compromise an organisation, system or application, and it is relative to what is being assessed; an attack vector is the route or method actually used.
• Supplementary: a vector is a route and a weakness is what makes the route exploitable; for a network service exposed on an open port, the vector is network access to the port and the weakness is a vulnerable or misconfigured service.
• Supplementary: in a message-based attack the communication channel is the vector, and the malicious link, attachment, request or deception is the content carried over it.
• Supplementary: a supply-chain attack reaches the target through a trusted supplier, vendor or dependency, such as a compromised software update, a managed service provider or a tampered library; an incident at a supplier is a supply-chain attack on its customer only when that trusted relationship is abused as the route in.
• Supplementary: the attack surface is reduced by removing what is not needed, restricting what is needed, and patching and monitoring what remains, for example by disabling unused services, closing unnecessary ports and removing unused accounts.
• Supplementary: Stuxnet targeted Siemens industrial control software and programmable logic controllers, could spread by removable media and exploited software vulnerabilities, showing that an attack on operational technology can have physical effects.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Attack Surfaces and Attack Vectors — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): attack surfaces and attack vectors were covered, including network vectors, message-based vectors by email, SMS, instant messaging, web and social media and voice calls, and the supply chain as an attack surface.
• Classroom (Session 8): Stuxnet was shown in a video as an example of a sophisticated attack against industrial systems.
• Supplementary: the attack surface is the total set of points where an attacker could interact with or try to compromise an organisation, system or application, and it is relative to what is being assessed; an attack vector is the route or method actually used.
• Supplementary: a vector is a route and a weakness is what makes the route exploitable; for a network service exposed on an open port, the vector is network access to the port and the weakness is a vulnerable or misconfigured service.
• Supplementary: in a message-based attack the communication channel is the vector, and the malicious link, attachment, request or deception is the content carried over it.
• Supplementary: a supply-chain attack reaches the target through a trusted supplier, vendor or dependency, such as a compromised software update, a managed service provider or a tampered library; an incident at a supplier is a supply-chain attack on its customer only when that trusted relationship is abused as the route in.
• Supplementary: the attack surface is reduced by removing what is not needed, restricting what is needed, and patching and monitoring what remains, for example by disabling unused services, closing unnecessary ports and removing unused accounts.
• Supplementary: Stuxnet targeted Siemens industrial control software and programmable logic controllers, could spread by removable media and exploited software vulnerabilities, showing that an attack on operational technology can have physical effects.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Attack Surfaces and Attack Vectors — Supplementary Study Guide explanation · Surface and vector; The surface depends on what you are assessing; Mapping an attack surface: a water and power company; Where IT meets operational technology; A vector is a route and a weakness makes it usable; Vulnerable software vectors; Compensating controls for systems that cannot be patched; Agent-based and agentless scanning; Network vectors; Message-based vectors; The supply chain as an attack surface; A real example: Stuxnet; Reducing the attack surface

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Attack Surfaces and Attack Vectors lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Email Spoofing and Business Email Compromise

Evidence: Mixed

Revision: Available · 6 questions · 4 flashcards

Exam relevance

• Security+ · 2.2 · direct

  Mapped on 8 October 2026 for the “Business email compromise” sub-bullet only. Course coverage and authored revision do not establish full objective coverage.

• Security+ · 4.5 · direct

  Mapped on 8 October 2026 for the “Email security” sub-bullets DMARC, DKIM and SPF only. No other part of objective 4.5 is taught. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 3 of 6 questions and 3 of 4 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 8): email spoofing and business email compromise were covered.
• Supplementary: forms of email spoofing include display-name spoofing, sender or domain spoofing, lookalike domains, Reply-To manipulation and the use of compromised legitimate accounts.
• Supplementary: SPF publishes which servers are authorised to send mail for a domain; DKIM adds a cryptographic signature that lets the receiver verify that the signing domain sent the message and that the signed content has not been altered; DMARC builds on SPF and DKIM alignment with the visible From domain, tells receivers how to handle failures and provides reporting.
• Supplementary: email authentication does not stop a fraudulent message sent from a genuinely compromised mailbox or from a lookalike domain that the attacker controls.
• Supplementary: business email compromise is a targeted fraud that impersonates or compromises a trusted business identity or account to make a convincing request, such as an urgent transfer or a change of supplier bank details, leading to financial or data loss; defences include verifying such requests through a separately known channel, requiring a second approver and protecting mailboxes with multi-factor authentication.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Social Engineering and Phishing — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): email spoofing and business email compromise were covered.
• Supplementary: forms of email spoofing include display-name spoofing, sender or domain spoofing, lookalike domains, Reply-To manipulation and the use of compromised legitimate accounts.
• Supplementary: SPF publishes which servers are authorised to send mail for a domain; DKIM adds a cryptographic signature that lets the receiver verify that the signing domain sent the message and that the signed content has not been altered; DMARC builds on SPF and DKIM alignment with the visible From domain, tells receivers how to handle failures and provides reporting.
• Supplementary: email authentication does not stop a fraudulent message sent from a genuinely compromised mailbox or from a lookalike domain that the attacker controls.
• Supplementary: business email compromise is a targeted fraud that impersonates or compromises a trusted business identity or account to make a convincing request, such as an urgent transfer or a change of supplier bank details, leading to financial or data loss; defences include verifying such requests through a separately known channel, requiring a second approver and protecting mailboxes with multi-factor authentication.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Social Engineering and Phishing — Supplementary Study Guide explanation · The idea; Why it works: psychological triggers; Impersonation and pretexting; The phishing family; Phishing and spear phishing; Smishing and vishing; Angler phishing; Pharming, typosquatting and watering holes; Pharming; Typosquatting; Watering-hole attacks; Email spoofing; SPF, DKIM and DMARC; Business email compromise; Legitimate persuasion and deceptive persuasion; Defending against social engineering

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Social Engineering and Phishing lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

MITRE ATT&CK: Tactics and Techniques

Evidence: Mixed

Revision: Available · 4 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 8): MITRE ATT&CK was covered as a resource on adversary tactics and techniques.
• Supplementary: ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge; it is a public knowledge base of observed adversary behaviour and not a product that detects or blocks attacks.
• Supplementary: a tactic is the adversary’s goal, the why; a technique is how the goal is achieved; a sub-technique is a more specific form of a technique; for example, creating a scheduled task is a technique used for the Persistence tactic.
• Supplementary: MITRE records which techniques threat groups, campaigns and software have been observed using, which turns adversary behaviour into threat knowledge that defenders can check their defences against.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Nation-State Actors, APTs and MITRE ATT&CK — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): MITRE ATT&CK was covered as a resource on adversary tactics and techniques.
• Supplementary: ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge; it is a public knowledge base of observed adversary behaviour and not a product that detects or blocks attacks.
• Supplementary: a tactic is the adversary’s goal, the why; a technique is how the goal is achieved; a sub-technique is a more specific form of a technique; for example, creating a scheduled task is a technique used for the Persistence tactic.
• Supplementary: MITRE records which techniques threat groups, campaigns and software have been observed using, which turns adversary behaviour into threat knowledge that defenders can check their defences against.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Nation-State Actors, APTs and MITRE ATT&CK — Supplementary Study Guide explanation · Nation-state actors; Deniability and attribution; Advanced persistent threats; How a multi-stage intrusion unfolds; Nation-state and APT are not the same thing; APT and unskilled attacker compared; Living off the land; A real example: Volt Typhoon; MITRE ATT&CK; Tactics, techniques and sub-techniques; From adversary behaviour to threat knowledge

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Nation-State Actors, APTs and MITRE ATT&CK lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Nation-State Actors, APTs and Living off the Land

Evidence: Mixed

Revision: Available · 7 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 8): nation-state actors and advanced persistent threats were covered, with Volt Typhoon as an example and living off the land as the use of tools already present in the victim’s environment.
• Supplementary: nation-state describes who the actor is or who sponsors it, while an advanced persistent threat describes a capable, targeted, persistent and stealthy style of threat or campaign; the two often overlap but are not synonyms.
• Supplementary: nation-state actors may be extremely well resourced but are not literally unlimited, and a state may pose as hacktivists to obscure attribution and keep plausible deniability.
• Supplementary: an advanced persistent threat is patient, targeted, persistent and well resourced and works in stages such as initial access, persistence, privilege escalation, lateral movement, collection and exfiltration, whereas an unskilled attacker is usually opportunistic and relies on ready-made tools.
• Supplementary: living off the land means using legitimate tools already present in the victim environment, such as PowerShell, command-line utilities and Windows Management Instrumentation, instead of relying solely on custom malware; it aids stealth because the activity resembles normal administration.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Nation-State Actors, APTs and MITRE ATT&CK — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): nation-state actors and advanced persistent threats were covered, with Volt Typhoon as an example and living off the land as the use of tools already present in the victim’s environment.
• Supplementary: nation-state describes who the actor is or who sponsors it, while an advanced persistent threat describes a capable, targeted, persistent and stealthy style of threat or campaign; the two often overlap but are not synonyms.
• Supplementary: nation-state actors may be extremely well resourced but are not literally unlimited, and a state may pose as hacktivists to obscure attribution and keep plausible deniability.
• Supplementary: an advanced persistent threat is patient, targeted, persistent and well resourced and works in stages such as initial access, persistence, privilege escalation, lateral movement, collection and exfiltration, whereas an unskilled attacker is usually opportunistic and relies on ready-made tools.
• Supplementary: living off the land means using legitimate tools already present in the victim environment, such as PowerShell, command-line utilities and Windows Management Instrumentation, instead of relying solely on custom malware; it aids stealth because the activity resembles normal administration.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Nation-State Actors, APTs and MITRE ATT&CK — Supplementary Study Guide explanation · Nation-state actors; Deniability and attribution; Advanced persistent threats; How a multi-stage intrusion unfolds; Nation-state and APT are not the same thing; APT and unskilled attacker compared; Living off the land; A real example: Volt Typhoon; MITRE ATT&CK; Tactics, techniques and sub-techniques; From adversary behaviour to threat knowledge

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Nation-State Actors, APTs and MITRE ATT&CK lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Phishing and Related Techniques

Evidence: Mixed

Revision: Available · 8 questions · 4 flashcards

Exam relevance

• Security+ · 2.2 · direct

  Mapped on 8 October 2026 for phishing, vishing, smishing, watering hole and typosquatting. Spear phishing, whaling, pharming and angler phishing are taught here but are not listed in the objective. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 3 of 8 questions and 2 of 4 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 8): the techniques covered were phishing, spear phishing, smishing, vishing, pharming, typosquatting, watering-hole attacks and angler phishing.
• Supplementary: phishing is broad deceptive messaging aimed at stealing information or causing an unsafe action, and spear phishing is targeted and personalised at a specific person or group; whaling is spear phishing aimed at senior or high-value individuals.
• Supplementary: smishing is phishing by SMS text message and vishing is phishing by voice call.
• Supplementary: pharming redirects users to a fraudulent destination, classically by manipulating DNS or other name resolution, so phishing tricks the person while pharming redirects the traffic and needs no message or click.
• Supplementary: typosquatting is registering a domain deliberately similar to a legitimate one so that users mistype it or fail to notice the difference; it can be combined with phishing, which is the deceptive message.
• Supplementary: in a watering-hole attack the attacker compromises a website the intended targets already visit and waits for them, whereas spear phishing goes to the target; angler phishing uses fake customer-support accounts on social media to hook people who are asking a company for help.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Social Engineering and Phishing — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): the techniques covered were phishing, spear phishing, smishing, vishing, pharming, typosquatting, watering-hole attacks and angler phishing.
• Supplementary: phishing is broad deceptive messaging aimed at stealing information or causing an unsafe action, and spear phishing is targeted and personalised at a specific person or group; whaling is spear phishing aimed at senior or high-value individuals.
• Supplementary: smishing is phishing by SMS text message and vishing is phishing by voice call.
• Supplementary: pharming redirects users to a fraudulent destination, classically by manipulating DNS or other name resolution, so phishing tricks the person while pharming redirects the traffic and needs no message or click.
• Supplementary: typosquatting is registering a domain deliberately similar to a legitimate one so that users mistype it or fail to notice the difference; it can be combined with phishing, which is the deceptive message.
• Supplementary: in a watering-hole attack the attacker compromises a website the intended targets already visit and waits for them, whereas spear phishing goes to the target; angler phishing uses fake customer-support accounts on social media to hook people who are asking a company for help.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Social Engineering and Phishing — Supplementary Study Guide explanation · The idea; Why it works: psychological triggers; Impersonation and pretexting; The phishing family; Phishing and spear phishing; Smishing and vishing; Angler phishing; Pharming, typosquatting and watering holes; Pharming; Typosquatting; Watering-hole attacks; Email spoofing; SPF, DKIM and DMARC; Business email compromise; Legitimate persuasion and deceptive persuasion; Defending against social engineering

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Social Engineering and Phishing lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Social Engineering, Impersonation and Pretexting

Evidence: Mixed

Revision: Available · 5 questions · 2 flashcards

Exam relevance

• Security+ · 2.2 · direct

  Mapped on 8 October 2026 for part of the “Human vectors/social engineering” bullet: impersonation and pretexting. Misinformation/disinformation and brand impersonation are not yet taught. Course coverage and authored revision do not establish full objective coverage.

• Security+ · 5.6 · direct

  Mapped on 8 October 2026 for recognising and responding to a social-engineering request only. Campaigns, programme development and reporting are not taught. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 2 of 5 questions and 2 of 2 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 8): social engineering was covered as exploiting trust and human psychology, together with impersonation and pretexting.
• Supplementary: social engineering targets the human, not just the technology, manipulating people into actions such as revealing passwords or multi-factor authentication codes, clicking links, transferring money or bypassing procedure.
• Supplementary: common psychological triggers include authority, urgency, fear, curiosity, trust, helpfulness, familiarity, reciprocity and social pressure.
• Supplementary: impersonation is who the attacker pretends to be, and pretexting is the believable story or scenario used to justify the request; a caller posing as IT support who invents an urgent account problem to obtain a code combines both with authority and urgency.
• Supplementary: rapport, persuasion and negotiation techniques are legitimate skills that become a security concern only when used deceptively to obtain access, data or compliance; an unexpected request for a code or payment should be verified through a separately known channel.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Social Engineering and Phishing — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): social engineering was covered as exploiting trust and human psychology, together with impersonation and pretexting.
• Supplementary: social engineering targets the human, not just the technology, manipulating people into actions such as revealing passwords or multi-factor authentication codes, clicking links, transferring money or bypassing procedure.
• Supplementary: common psychological triggers include authority, urgency, fear, curiosity, trust, helpfulness, familiarity, reciprocity and social pressure.
• Supplementary: impersonation is who the attacker pretends to be, and pretexting is the believable story or scenario used to justify the request; a caller posing as IT support who invents an urgent account problem to obtain a code combines both with authority and urgency.
• Supplementary: rapport, persuasion and negotiation techniques are legitimate skills that become a security concern only when used deceptively to obtain access, data or compliance; an unexpected request for a code or payment should be verified through a separately known channel.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Social Engineering and Phishing — Supplementary Study Guide explanation · The idea; Why it works: psychological triggers; Impersonation and pretexting; The phishing family; Phishing and spear phishing; Smishing and vishing; Angler phishing; Pharming, typosquatting and watering holes; Pharming; Typosquatting; Watering-hole attacks; Email spoofing; SPF, DKIM and DMARC; Business email compromise; Legitimate persuasion and deceptive persuasion; Defending against social engineering

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Social Engineering and Phishing lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Threat Actor Types, Attributes and Intent

Evidence: Mixed

Revision: Available · 9 questions · 3 flashcards

Exam relevance

• Security+ · 2.1 · direct

  Mapped on 8 October 2026 for threat actors and the attributes of actors. Competitor, threat knowledge and the targeted-or-opportunistic scale are taught here but are not in the objective; the motivations ethical, war and disruption/chaos are not yet taught. Course coverage and authored revision do not establish full objective coverage.

Verified for Security+: 3 of 9 questions and 0 of 3 flashcards. The mapping does not verify the others.

Reviewed revision scope

• Classroom (Session 8): the threat actor categories covered were nation-state, organised crime, hacktivist, insider, unskilled attacker and competitor, and Shadow IT was listed with them.
• Classroom (Session 8): the attributes covered were internal or external source, sophistication and capability, resources and funding, threat knowledge and adversary behaviour, with threat knowledge meaning the defender’s understanding of threats; intent was covered as maliciously targeted, opportunistic, or accidental and unintentional.
• Supplementary: four questions separate ideas that are easily confused: who is the threat actor, why is the intent or motivation, how is the attack vector and where is the attack surface.
• Supplementary: Shadow IT is unauthorised or unmanaged technology used for work, usually by staff trying to get their jobs done; it is an organisational risk that brings unmanaged data, weak access control, compliance problems and reduced visibility, and it is not a threat actor in the strict sense.
• Supplementary: internal or external describes the source and trust relationship, malicious or unintentional describes intent, and targeted or opportunistic describes how deliberately the victim was selected; an opportunistic attack can still be malicious, and none of these words is a threat actor type.
• Supplementary: typical drivers are financial gain for organised crime, a political or social cause for hacktivists and commercial advantage for competitors, although motives overlap; nation-state is an actor type and not a motivation; an unskilled attacker has limited capability and resources and relies on ready-made tools.
• Supplementary: threat knowledge covers what defenders know, such as known actors, tactics and techniques, vulnerabilities and indicators of compromise, while adversary behaviour is what attackers actually do; a contractor with trusted, authorised access can present insider risk wherever they work, and when an employee takes files to a rival the direct actor is the insider.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Threat Actor Types, Attributes and Motivations — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): the threat actor categories covered were nation-state, organised crime, hacktivist, insider, unskilled attacker and competitor, and Shadow IT was listed with them.
• Classroom (Session 8): the attributes covered were internal or external source, sophistication and capability, resources and funding, threat knowledge and adversary behaviour, with threat knowledge meaning the defender’s understanding of threats; intent was covered as maliciously targeted, opportunistic, or accidental and unintentional.
• Supplementary: four questions separate ideas that are easily confused: who is the threat actor, why is the intent or motivation, how is the attack vector and where is the attack surface.
• Supplementary: Shadow IT is unauthorised or unmanaged technology used for work, usually by staff trying to get their jobs done; it is an organisational risk that brings unmanaged data, weak access control, compliance problems and reduced visibility, and it is not a threat actor in the strict sense.
• Supplementary: internal or external describes the source and trust relationship, malicious or unintentional describes intent, and targeted or opportunistic describes how deliberately the victim was selected; an opportunistic attack can still be malicious, and none of these words is a threat actor type.
• Supplementary: typical drivers are financial gain for organised crime, a political or social cause for hacktivists and commercial advantage for competitors, although motives overlap; nation-state is an actor type and not a motivation; an unskilled attacker has limited capability and resources and relies on ready-made tools.
• Supplementary: threat knowledge covers what defenders know, such as known actors, tactics and techniques, vulnerabilities and indicators of compromise, while adversary behaviour is what attackers actually do; a contractor with trusted, authorised access can present insider risk wherever they work, and when an employee takes files to a rival the direct actor is the insider.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Threat Actor Types, Attributes and Motivations — Supplementary Study Guide explanation · Four questions that keep the ideas apart; Vulnerability, threat and risk; The main types of threat actor; Six types compared; Unskilled attackers; Organised crime and competitors; Hacktivists; Shadow IT is a risk, not an actor; Attributes used to compare actors; Threat knowledge and adversary behaviour; Intent, objectives and drivers; Two different scales of intent; Insider threats; Contractors and working from home; An employee who leaves for a rival (fictional); Leadership and security culture

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Threat Actor Types, Attributes and Motivations lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.

Threat Actors

Evidence: Supplementary

Revision: Available · 3 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Supplementary comparisons distinguish motivation, capability and opportunity, malicious insider activity, mistakes and uncertain attribution.

• Threat Actors — Supplementary Study Guide explanation

Recorded evidence

• Supplementary comparisons distinguish motivation, capability and opportunity, malicious insider activity, mistakes and uncertain attribution.

• Threat Actors — Supplementary Study Guide explanation · The idea; Categories are starting points; Motivation, capability and opportunity; Compare two fictional attempts; People and mistakes; Respond to the event and investigate the context; A defensive question; Further reading

Reviewed 2026-09-23. Reviewed against approved Sessions 1–2 and Study Buddy Core Concepts. Scenarios are fictional educational applications, not completed practical work. This concept has not yet been individually verified against the Security+ SY0-701 objectives or any other exam syllabus.

Vulnerability, Threat and Risk

Evidence: Mixed

Revision: Available · 4 questions · 2 flashcards

Exam relevance

Learning-only · no verified exam mapping

Reviewed revision scope

• Classroom (Session 8): vulnerabilities, threats and risk were related to one another, and risk was related to impact and likelihood.
• Supplementary: a vulnerability is a weakness, a threat is a potential danger capable of exploiting a weakness, and risk is the potential harm that results; a threat exploiting a vulnerability creates risk.
• Supplementary: the level of a risk is judged from likelihood and impact together, which is a separate statement from how a risk arises; for a VPN without multi-factor authentication the vulnerability is the missing second factor, the threat is an attacker with stolen credentials and the risk is unauthorised remote access.
• Supplementary: fixing a vulnerability lowers the likelihood of harm without removing the threat.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record
• Threat Actor Types, Attributes and Motivations — Supplementary Study Guide explanation

Recorded evidence

• Classroom (Session 8): vulnerabilities, threats and risk were related to one another, and risk was related to impact and likelihood.
• Supplementary: a vulnerability is a weakness, a threat is a potential danger capable of exploiting a weakness, and risk is the potential harm that results; a threat exploiting a vulnerability creates risk.
• Supplementary: the level of a risk is judged from likelihood and impact together, which is a separate statement from how a risk arises; for a VPN without multi-factor authentication the vulnerability is the missing second factor, the threat is an attacker with stolen credentials and the risk is unauthorised remote access.
• Supplementary: fixing a vulnerability lowers the likelihood of harm without removing the threat.

• Session 8: Threat Actors, Attack Surfaces and Social Engineering — Classroom session record · Threat actors and their categories; Threat actor attributes; Intent, objectives and motivations; Nation-state actors and advanced persistent threats; Volt Typhoon and living off the land; MITRE ATT&CK; Organised crime and competitors; Insider threats; Vulnerability, threat and risk; Leadership and security culture; Attack surfaces and attack vectors; Vulnerable software and vulnerability scanning; Network vectors; Stuxnet; Message-based vectors; Supply-chain attack surface; Social engineering; Impersonation and pretexting; Phishing and related techniques; Email spoofing and business email compromise; Supplementary behavioural resources
• Threat Actor Types, Attributes and Motivations — Supplementary Study Guide explanation · Four questions that keep the ideas apart; Vulnerability, threat and risk; The main types of threat actor; Six types compared; Unskilled attackers; Organised crime and competitors; Hacktivists; Shadow IT is a risk, not an actor; Attributes used to compare actors; Threat knowledge and adversary behaviour; Intent, objectives and drivers; Two different scales of intent; Insider threats; Contractors and working from home; An employee who leaves for a rival (fictional); Leadership and security culture

Authored and machine-validated on 5 October 2026; owner review pending. Checked during authoring against the Session 8 Learning Log and the Threat Actor Types, Attributes and Motivations lesson Sources and scope section. Scope statements are labelled Classroom or Supplementary: Classroom statements record what the session covered, and beginner-first wording developed afterwards is labelled Supplementary. No practical competence, completed assessment or exam alignment is implied.