# What is an APT (advanced persistent threat)?

An APT (advanced persistent threat) is a skilled, well-resourced attacker, often state-backed, who targets specific organisations and tries to stay inside for a long time without being noticed, usually for espionage or sabotage. Advanced means they use custom tools and careful methods; persistent means they keep coming back. Their targets include governments, defence, energy and their suppliers, which is how mid-sized companies end up in scope. Such attackers avoid noisy malware and use normal admin tools instead, so the signs are mostly behavioural: unusual connections between internal machines and quiet, regular contact with outside servers.

FAQ: [What is…? Network and security terms](https://netsenx.com/en/faq/glossary) · https://netsenx.com/en/faq/what-is-an-apt

## Read next

- https://netsenx.com/en/what-is-ndr
- https://netsenx.com/en/problems-we-solve

## Related questions

- [What are false positives and false negatives?](https://netsenx.com/en/faq/what-are-false-positives-and-false-negatives)
- [What is a SOC (security operations centre)?](https://netsenx.com/en/faq/what-is-a-soc-security-operations-centre)
- [What is a CSIRT or CERT?](https://netsenx.com/en/faq/what-is-a-csirt-or-cert)
- [What is a penetration test?](https://netsenx.com/en/faq/what-is-a-penetration-test)
- [What are red teams and blue teams?](https://netsenx.com/en/faq/what-are-red-teams-and-blue-teams)