In cybersecurity, a threat agent (also called a threat actor) is:
An individual, group, organization, or even a process that takes advantage of a vulnerability to carry out a threat. In the case of elementary threats caused naturally, “nature” can be assumed to be the threat agent.
Key characteristics:
Has intent (malicious or accidental)
Has capability to exploit vulnerabilities
Acts on behalf of a threat (e.g., malware delivery, espionage, sabotage)
Common types of threat agents:
Type | Example |
|---|---|
Cybercriminals | Ransomware gangs, phishing scammers |
Nation-state actors | Government-sponsored hacking groups |
Hacktivists | Anonymous, politically motivated attackers |
Insiders | Disgruntled employees, careless staff |
Automated scripts/bots | Malware, worms, or scanners |
Example:
In a phishing attack:
Threat: Credential theft
Threat agent: The attacker who sends the phishing email
Attack vector: The malicious email
Vulnerability: User clicks link without verifying