How should security teams distinguish targeted attacks from untargeted attacks when prioritising controls?

How to think about the attack pattern before you pick controls

Targeted and untargeted attacks differ less by toolset than by intent and focus. Untargeted activity is usually opportunistic, high-volume, and designed to find any weak exposure at scale. Targeted activity is narrower, more deliberate, and aimed at a specific environment, asset, or data set, which means controls should be chosen around likely impact paths rather than generic coverage alone.

That distinction matters because the same control can be valuable in both cases, but for different reasons. Baseline hardening reduces the success rate of broad scanning and commodity exploits, while asset-specific visibility, segmentation, and tighter administrative controls matter most when an attacker is likely to invest time in one organisation.

When teams blur the two, they tend to overspend on perimeter noise reduction and underspend on detection around crown-jewel systems. A targeted campaign often succeeds by staying quiet, using legitimate access paths, or chaining small weaknesses that would not matter in a purely opportunistic attack.

• For untargeted attacks, prioritise controls that reduce exposure across the widest population of systems.
• For targeted attacks, prioritise controls that raise the cost of movement and limit blast radius around critical assets.
• Use asset criticality to decide where deeper monitoring and response speed matter most.

Controls that separate broad opportunism from focused compromise

Untargeted attacks are usually best countered with strong hygiene: patching, secure configuration, MFA where practical, logging, and vulnerability management. Those controls reduce the number of easy wins available to mass exploitation and commodity malware, which is exactly where untargeted actors tend to compete on volume.

Targeted attacks need a different control mix because the attacker is willing to wait, adapt, and reuse access once gained. That is why segmentation, privileged access control, enhanced alerting on sensitive systems, and tighter review of unusual access paths matter more when the threat is a directed campaign. The 52 NHI breaches Report is useful here because it shows how compromise often escalates when attackers reach credentials, service accounts, or other high-trust pathways.

For teams with high-value environments, the practical question is not whether a control exists somewhere in the stack, but whether it constrains the most likely failure path. If a control only helps after initial compromise but does not slow privilege expansion, it is usually more valuable against targeted attacks than against broad opportunism.

One useful discriminator is whether the attacker needs persistence. Untargeted activity often succeeds or fails quickly. Targeted activity frequently involves dwell time, lateral movement, and selective exfiltration, so controls that improve detection fidelity on sensitive systems become more important than controls that only reduce background noise.

Risk and Threat Considerations

Targeted attacks create greater exposure because the attacker can align access, timing, and victim selection to the organisation’s most sensitive systems. Untargeted attacks create broader operational risk because they exploit whatever is exposed at scale, which can overwhelm weak controls and response capacity even when the attacker has no specific victim in mind.

Failure mechanism: Teams misclassify a directed campaign as routine noise, so alerts stay too coarse, segmentation stays too flat, and privileged access paths remain too easy to abuse. In the opposite direction, they may overbuild niche controls for broad attacks instead of reducing common exposure first.

Impact: Misprioritisation increases the chance that a high-value asset is reached, a compromised foothold is reused, or the organisation loses time during triage because the control set was optimised for the wrong attack model.

Practitioner Guidance

What to prioritise: Start by separating controls that reduce total exposure from controls that protect specific assets. The first category should be aimed at every internet-facing and high-churn system; the second should be reserved for systems where compromise would materially change business impact.

What to verify: Check whether your most sensitive systems have different monitoring thresholds, tighter admin paths, and faster response playbooks than the rest of the environment. If they do not, the control design is probably still treating targeted and untargeted activity as the same problem.

Common mistake: Assuming “more alerts” equals better targeted-attack defence. In practice, the better signal is whether unusual access, privilege escalation, or lateral movement on critical assets can be distinguished quickly from normal noise.

Practitioner takeaway: Use the attacker's intent to decide where depth matters, broad attacks justify breadth of hygiene, but targeted attacks justify precision around access, segmentation, and response speed.

Related resources from NHI Mgmt Group

• How should security teams evaluate identity controls against AI-driven attacks?
• How can security teams defend identity controls against machine-speed parallel attacks?
• How should security teams validate that their controls still work against current attacks?
• How should security teams adapt IAM and NHI controls to machine-speed attacks?