Adversary Modeling and Threat Profiles

Adversary modeling consists of building detailed profiles of the threat actors most relevant to a specific organization, documenting their motivations, technical capabilities, usual infrastructure and typical targets, to anticipate how they could attack instead of reacting only after the fact. In practice, not every organization faces the same threat landscape, so focusing modeling on the groups that have historically attacked the company's sector, region or type of technology is far more valuable than trying to generically profile every known actor in the industry. A useful threat profile combines technical intelligence, such as the techniques and tools used, with motivational context, distinguishing for example between a financially motivated group that will look for the path of least effort and a state-sponsored actor with espionage goals that will invest much more time in stealthy persistence. Keeping these profiles up to date makes it possible to adjust controls proactively before the modeled adversary actually attempts an attack.