A teenager with a downloaded scanner and a foreign intelligence service can both end up on your network. What separates them is what they bring with them: whether they started with legitimate access, how much money and time they can spend, and how skilled they are.
On the CompTIA Security+ SY0-801 exam these are the attributes of threat actors, listed under objective 2.2 next to actor types and motivations. Motivation says what an actor wants; attributes say what it can do about it. This lesson covers the three attributes, puts every actor type side by side, and shows how scenarios combine them.
Three attributes describe what an actor can do to you
A threat needs intent and capability. The previous lesson covered intent, which is motivation. The attributes describe capability and starting position:
- Internal or external: whether the actor begins with access the organization granted.
- Resources and funding: the money, people, time and infrastructure the actor can bring.
- Level of sophistication or capability: the skill and tooling behind the attack.
These attributes turn a vague worry into a realistic list of opponents. A small dental office and a defense contractor both face ransomware crews, but only the contractor realistically faces a state intelligence service willing to spend a year getting in. Risk assessments use that judgment when they estimate likelihood: an attack is more likely when someone has both the motive and the capability to carry it out. Each organization then spends on controls that defeat the actors it is likely to face, instead of trying to defend equally against everyone.
Attributes also guide incident response. Evidence of a highly capable actor means the team should assume more systems are compromised than the ones already found and expect the intruder to have planted ways back in. Evidence of a low-skill actor suggests the damage is more likely limited to what is visible, although the team still has to confirm that.
Internal actors start with access the organization granted
An internal actor has authorized access to the organization's systems, facilities or data. That includes employees, contractors, temporary staff and interns, and third parties with accounts, such as a managed service provider's technicians or a vendor's support engineers. An external actor has no granted access and must obtain it, by phishing, exploiting an exposed service, buying stolen credentials, or getting through a door.
The attribute is about the relationship, not the network location. An outsider who phishes a password and signs in through the VPN is still external, even though the traffic comes from an internal address. An employee working from a coffee shop is still internal. Scenario questions can use this distinction to catch people who equate "inside the network" with "insider".
Internal actors have advantages no outsider starts with. They skip the perimeter entirely, know where valuable data is stored and which systems are poorly monitored, and their activity looks like normal work because it uses real accounts. Coworkers trust them, which makes social engineering inside the company easier. That is why insider incidents are often discovered late. The accidental actor is internal too: many data exposures start with an employee's mistake rather than an attack.
External actors have numbers on their side: anyone on the internet can try. Defenses against them focus on the edge and on identity, such as patching exposed services, MFA, email filtering and reducing what is reachable from the internet. Defenses against internal actors focus on limiting and watching granted access: least privilege, separation of duties, job rotation, mandatory vacations, regular access reviews, data loss prevention, and behavior analytics that flag a user who suddenly reads far more than usual.
The line also blurs on purpose. External groups recruit insiders, and some ransomware groups have openly advertised for employees willing to sell their network access for a share of the ransom. A scenario where an outsider pays an employee to plant malware involves both an external actor and an internal one.