Who attacks and why

The single most useful shift in how you think about attackers is to stop imagining one person at a keyboard and start imagining a market. The clearest example is ransomware-as-a-service, usually shortened to RaaS. Instead of one gang doing everything, the work is split between specialists who buy and sell from each other, exactly like any other industry.

At one end, developers write the malware and license it out, running it like a software company with updates, dashboards and support. They typically keep a fixed share of any ransom, in the region of 20 to 30 percent. Separately, an initial access broker sells a ready-made foothold: stolen remote-access credentials or a live session into a target network, priced per victim. An affiliate then rents the malware, buys the access, and actually runs the intrusion, keeping the largest share of the proceeds, often 70 to 80 percent. When the victim pays, a launderer moves the cryptocurrency through mixers and exchanges and takes a cut to convert it into usable funds.

The reason this matters for defence is structural. Once attacking is a business with specialists and margins, it scales. Brokers sell the same kind of foothold to many affiliates, affiliates run the same playbook against many victims, and the tooling is bought rather than invented. So a defender should plan for commodity techniques arriving in volume, not for a bespoke, one-off masterpiece aimed personally at them. The figure below traces a single intrusion down through the chain and marks the cut each link takes.

Attackers are easiest to reason about through their motivation, because motivation predicts behaviour: how persistent they will be, which targets they choose, and what counts as success for them. Four broad classes cover most of what a typical organisation faces.

Financially motivated criminals are behind most incidents. They want profit at scale, they get in through phishing and stolen credentials, and they persist only for as long as it keeps paying. Success for them is a ransom paid or data resold. State actors are after espionage and quiet prepositioning inside systems they may want to disrupt later. They can afford zero-day exploits and supply-chain routes, they stay patient and hidden, and success is access that is never noticed. A hacktivist wants publicity for a cause, favours noisy techniques such as distributed denial of service and website defacement, runs in short campaigns, and counts visible disruption as a win. ENISA found that hacktivist activity, dominated by denial-of-service attacks, made up roughly 77 percent of the incidents it counted between July 2024 and June 2025, a reminder that loud and frequent is not the same as damaging.

The fourth class is different in kind. An insider threat is someone who already has legitimate access, so there is no intrusion to detect at all. Their motive may be grievance, greed or coercion, they are already inside the perimeter, and success is data taken before anyone notices. No firewall sits between an insider and the data they are trusted with, which is why this class needs a different set of controls built around monitoring and separation of duties rather than keeping attackers out.

Threat statistics are quoted in board papers all the time, and they are often mishandled. The two most cited annual sources are the ENISA Threat Landscape and the Verizon Data Breach Investigations Report, and they do not measure the same thing. Knowing the difference is what lets you use a number honestly.

The 2025 ENISA Threat Landscape looked at roughly 4,875 incidents recorded across Europe. It found ransomware to be the most impactful threat, that phishing accounted for about 60 percent of initial access, and that vulnerability exploitation featured in about 21 percent of cases. The Verizon 2025 report, by contrast, studies confirmed breaches: it found ransomware present in 44 percent of them, that third-party involvement had doubled to around 30 percent, and that exploitation of edge and virtual private network devices had risen roughly eightfold. Both are credible, but the first counts incidents and the second counts breaches, and an incident is not the same as a breach.

That distinction is the whole point. A population of all recorded incidents is swollen by high-volume, low-impact events such as denial-of-service floods, so hacktivism looks enormous in it. A population of confirmed breaches strips those out and shows what actually caused damage, so ransomware and stolen credentials rise to the top. Before you quote a percentage, ask what the denominator is: percentage of what, counted by whom, over what period. A number without its denominator is a decoration, not evidence.

If you take the evidence seriously, it tells you where to spend attention. Most breaches still begin in a small number of ordinary ways: someone is phished, a credential is stolen or reused, or an internet-facing device is left unpatched. Exotic techniques exist, but they are not where the volume is. A course that matched effort to risk would therefore spend most of its depth on identity, on reducing exposure, and on detecting intrusions early, because that is where commodity attacks land.

That is exactly how the rest of this course is weighted. The idea that attackers behave in patterns you can plan against, which is the payoff of forward-defining double extortion and the actor classes here, feeds directly into how you reason about likelihood in the next module on risk and outcomes. You now have the vocabulary for who is on the other side; risk turns that into a judgement about what to protect first.