What is an APT (advanced persistent threat)?

An APT (advanced persistent threat) is a skilled, well-resourced attacker, often state-backed, who targets specific organisations and tries to stay inside for a long time without being noticed, usually for espionage or sabotage. Advanced means they use custom tools and careful methods; persistent means they keep coming back. Their targets include governments, defence, energy and their suppliers, which is how mid-sized companies end up in scope. Such attackers avoid noisy malware and use normal admin tools instead, so the signs are mostly behavioural: unusual connections between internal machines and quiet, regular contact with outside servers.

← All 69 questions on What is…? Network and security termsAll topics