Understanding Adversary
Introduction
An adversary is an individual, group, organization, or other entity that opposes another entity or acts against its interests. In Cybersecurity, an adversary is an entity that may seek to compromise, disrupt, manipulate, obtain unauthorized access to, or otherwise affect a system, network, application, device, information resource, or other target.
The term is used broadly and does not necessarily imply that an attack is currently taking place. An adversary may represent a potential or actual source of hostile activity, depending on its intent, capabilities, resources, and opportunity to act against a target.
In cybersecurity, understanding an adversary involves examining who the adversary is, what motivates it, what it intends to achieve, what capabilities and resources it possesses, and how it may operate against a target.
What Is an Adversary?
The word adversary refers to an opponent or an entity that acts in opposition to another entity. In cybersecurity, the term describes an individual, group, organization, or other entity that may act against a target’s security interests.
An adversary may seek to obtain unauthorized access, acquire information, alter or destroy data, disrupt services, compromise systems, or achieve another objective that conflicts with the interests of the target.
An adversary does not necessarily have to be actively conducting an attack. An entity may be considered an adversary based on its potential to act against a target, particularly when it possesses relevant intent, capabilities, resources, or access.
The identity of an adversary can vary considerably. It may be an individual acting independently, a group operating collectively, an organized criminal entity, a state or state-sponsored entity, an insider, or another entity capable of acting against a target.
The concept therefore focuses primarily on the opposing entity, rather than on a specific attack, tool, technique, or event. The same adversary may use different methods at different times depending on its objectives, capabilities, resources, and the target environment.
Understanding an adversary consequently involves examining the characteristics that influence its potential actions, including its identity, motivation, intent, capability, resources, targets, and behavior.
Adversary, Threat Actor, and Attacker
These terms are closely related, but they describe slightly different concepts.
| Term | Meaning |
|---|---|
| Adversary | The opposing entity that may act against a target or its security interests. |
| Threat Actor | An entity associated with malicious activity or capable of carrying out malicious actions. |
| Attacker | An entity actively attempting to compromise, disrupt, manipulate, or otherwise attack a target. |
An adversary is the broadest concept. It represents an entity that may act against a target.
A threat actor refers to an entity associated with malicious activity or capable of conducting such activity.
An attacker generally refers to an entity that is actively attempting to compromise or attack a target.
The term threat is different from all three. A threat describes the potential for an adverse event or action that could cause harm. The threat may originate from an adversary or threat actor.
Why Understanding the Adversary Matters
Security cannot be understood only by looking at the systems being protected. It is also necessary to consider the entities that may attempt to compromise those systems.
Understanding an adversary helps answer questions such as:
- Who might target the asset?
- Why would they target it?
- What are they trying to achieve?
- What capabilities might they possess?
- What resources could they use?
- What weaknesses might they attempt to exploit?
- What methods might they use?
- What behavior could indicate their activity?
These questions help connect security controls with the threats they are intended to address.
Adversary Identity and Origin
An adversary can originate from many different environments.
An individual may act independently, while a group may operate with shared objectives and resources. An organization may conduct activities to obtain information or competitive advantage. A state or state-sponsored group may pursue intelligence, political, military, or strategic objectives.
The identity and origin of an adversary can influence its objectives, resources, capabilities, and methods.
However, identity alone does not determine how an adversary will behave. Different adversaries can have similar objectives, while adversaries with similar origins can have very different objectives and capabilities.
Adversary Motivation
Motivation describes why an adversary wants to act against a target.
Common motivations include financial gain, espionage, political objectives, ideological objectives, disruption, intelligence gathering, competitive advantage, and personal or organizational interests.
Understanding motivation helps provide context for potential adversary behavior.
For example, an adversary motivated by financial gain may focus on obtaining valuable information, credentials, or access that can be monetized. An adversary motivated by espionage may prioritize information rather than immediate financial return.
Motivation does not by itself determine an attack, but it helps explain why a particular target may be attractive.
Adversary Intent
Intent describes what an adversary wants to accomplish.
Motivation explains why the adversary may act, while intent describes what the adversary seeks to achieve.
An adversary may intend to:
- Obtain unauthorized access
- Steal information
- Manipulate data
- Disrupt services
- Damage systems
- Establish persistent access
- Observe activities
- Influence decisions
- Obtain financial benefit
Understanding intent is important because different objectives can lead to different behaviors and security requirements.
Adversary Capability
Capability represents what an adversary is capable of doing.
Capability can include technical knowledge, skills, access to tools, ability to develop or acquire techniques, operational experience, and the ability to exploit particular weaknesses.
Not every adversary has the same level of capability.
Some may have limited technical knowledge and rely on readily available tools. Others may possess highly specialized expertise and the ability to develop sophisticated techniques.
Capability should therefore be considered independently from motivation and intent.
Adversary Resources
Resources are the means available to an adversary for pursuing an objective.
Resources may include:
- Financial resources
- Personnel
- Technical expertise
- Computing infrastructure
- Information
- Malware and other software
- Compromised systems
- External services
- Time
- Operational access
An adversary with significant resources may be able to sustain activity for longer periods or pursue more complex objectives.
Adversary Targets
An adversary does not necessarily target every system or asset equally.
Targets may include:
- Individuals
- User accounts
- Applications
- Networks
- Devices
- Data
- Cloud resources
- Industrial systems
- Critical infrastructure
- Organizations
- Government systems
Target selection can depend on the adversary’s motivation, intent, available capabilities, and the perceived value or accessibility of the target.
Understanding what an adversary may value helps establish a clearer view of potential exposure.
How an Adversary Operates
An adversary’s actions are influenced by its objectives, capabilities, resources, and environment.
An adversary may first identify a target and gather information about it. It may then attempt to obtain access, exploit weaknesses, establish a presence, move toward valuable resources, achieve its objective, and attempt to avoid detection.
The exact sequence is not always the same. Adversaries can change their behavior based on the target, defensive measures, available opportunities, and the results of previous actions.
Therefore, adversary activity should not be viewed as a single fixed process.
Adversary Tactics, Techniques, and Procedures
Adversary behavior can be described through Tactics, Techniques, and Procedures (TTPs).
Tactics describe the adversary’s broader objective or purpose.
Techniques describe the methods used to achieve those objectives.
Procedures describe how a particular adversary implements those techniques in practice.
TTPs are useful because they allow cybersecurity professionals to understand adversary behavior beyond simply identifying malicious software or individual indicators.
Adversary Behavior and Patterns
Adversaries often demonstrate patterns in how they select targets, obtain access, move through environments, interact with systems, and pursue their objectives.
Studying these patterns can help identify suspicious activity and improve defensive capabilities.
However, adversary behavior can change. An adversary may modify its techniques when existing methods are detected or when the target environment changes.
Understanding adversaries therefore requires attention to both known behavior and potential adaptation.
The Adversary–Defender Relationship
Cybersecurity can be viewed as an ongoing relationship between an adversary and a defender.
The adversary attempts to achieve an objective while the defender attempts to prevent, detect, contain, respond to, and recover from unwanted activity.
This creates an environment in which both sides influence the outcome.
When defensive controls become more effective, adversaries may change their methods. When adversary behavior changes, defenders may need to adjust their controls and detection capabilities.
This relationship is one reason cybersecurity cannot rely on a single security control or a completely static security model.
Adversary in Threat Modeling
Threat modeling considers potential adversaries when analyzing how a system could be compromised.
An adversary-oriented approach asks questions such as:
Who could target the system?
What might they want?
What capabilities might they possess?
What assets could they target?
What paths could they potentially use?
These questions help identify potential threats and security requirements before or during the design of a system.
Adversary in Cybersecurity Risk
Risk exists when a potential threat can affect something of value.
Understanding the adversary helps provide context for evaluating that risk.
The combination of an adversary’s motivation, intent, capability, resources, and potential access can influence how a particular threat should be considered.
This does not mean that every capable adversary represents the same level of risk. Risk also depends on the value of the target, vulnerabilities, exposure, existing controls, and potential impact.
Conclusion
An adversary is an entity that may act against a target in pursuit of an objective that conflicts with the target’s security interests.
Understanding an adversary requires looking beyond the fact that an attack may occur. It involves understanding who the adversary is, why it may act, what it wants to achieve, what it can do, what resources it possesses, what it may target, and how it may behave.
This perspective provides an important foundation for understanding cybersecurity threats, attacks, risk, threat modeling, security architecture, security operations, incident response, and cyber resilience.
References
NIST – Adversary
Provides an authoritative definition of an adversary and explains the term in the context of cybersecurity and information security.
NIST – Threat Actor
Defines a threat actor and provides terminology for understanding individuals, groups, or organizations associated with malicious activity.
MITRE – MITRE ATT&CK
Provides a knowledge base of adversary tactics and techniques that helps explain how adversaries operate and pursue their objectives.
MITRE – Enterprise Tactics
Describes the tactical objectives associated with adversary behavior and provides a structured view of activities adversaries may perform during an intrusion.
NIST – Guide to Cyber Threat Information Sharing, SP 800-150
Provides guidance on cyber threat information sharing and helps organizations understand and communicate information about threats, threat actors, and adversary activity.
