# What is a threat actor?

A threat actor is whoever is behind an attack: a criminal group, a state-backed team, a hacktivist, a lone individual or an insider such as an unhappy employee. The term is used because a person or group, not a piece of software, is making the decisions. Most attacks on small and mid-sized companies come from criminal groups motivated by money, usually through ransomware, extortion or invoice fraud, and they choose victims by opportunity rather than by name. Knowing which actors target your industry helps decide where to spend first, but the basic defences are the same for almost all of them.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-is-a-threat-actor

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What is an APT (advanced persistent threat)?](https://netsenx.com/en/faq/what-is-an-apt)
- [What are false positives and false negatives?](https://netsenx.com/en/faq/what-are-false-positives-and-false-negatives)
- [What is a SOC (security operations centre)?](https://netsenx.com/en/faq/what-is-a-soc-security-operations-centre)
- [What is a CSIRT or CERT?](https://netsenx.com/en/faq/what-is-a-csirt-or-cert)
- [What is a penetration test?](https://netsenx.com/en/faq/what-is-a-penetration-test)