An adversary is an actor that tries to break into, disrupt, or exploit a system. In cybersecurity, the term covers external attackers, malicious insiders, criminal groups, and state-aligned operators, using methods such as phishing, malware, credential theft, and privilege escalation to gain access or cause harm.
What adversaries do in cybersecurity
An adversary is defined by intent and action, not by role alone. In security work, the term covers anything from opportunistic criminals to insider misuse and state-backed operations, so the central question is usually what the adversary is trying to achieve, what access they need, and which control or trust assumption they are trying to break.
This matters because different adversaries use different paths. A phishing operator depends on deception and credential capture, while a privileged insider may already have legitimate access and only needs to abuse it. Treating all hostile activity as one generic “attacker” obscures the mechanisms that determine how exposure actually begins.
Adversary objectives and attack paths
Most adversary activity in cybersecurity follows a predictable sequence: gain a foothold, maintain access, expand privileges, and reach a target such as data theft, disruption, extortion, or sabotage. The same broad term can therefore describe very different campaigns, from one-shot opportunistic intrusion to long-running intrusion sets with reconnaissance, persistence, and lateral movement.
The adversary’s objective is what makes the term operationally useful. When the goal is credential theft, the attacker will focus on authentication weak points and reuse opportunities; when the goal is disruption, the focus may shift to availability, destructive actions, or service degradation. That is why the term is usually paired with threat technique, campaign, or actor analysis.
Why adversary classification matters
Knowing that a hostile actor is present is not enough. Defenders need to understand whether the adversary is external or internal, whether they can operate quietly, whether they have financial, political, or espionage motives, and whether the environment gives them easy paths through trust, privilege, or weak segmentation.
This classification shapes prioritisation. A commodity criminal group may be best deterred by stronger authentication and faster detection, while a patient, well-resourced operator may require tighter monitoring, better segmentation, and stronger response readiness. The same organisation can face multiple adversary types at once, which is why threat modelling should avoid assuming one universal attacker profile.
How defenders analyze adversaries
Defenders typically analyze adversaries through observed techniques, likely targets, and the trust relationships they exploit. MITRE ATT&CK Enterprise Matrix is useful here because it maps hostile behavior to tactics such as credential access, privilege escalation, and lateral movement.
For broader cyber threat monitoring, CISA cyber threat advisories help teams connect adversary activity to current government guidance, especially when campaigns affect multiple sectors or involve ransomware and other high-impact intrusion patterns.
Where the adversary is using AI systems or agentic workflows as part of the intrusion path, MITRE ATLAS adversarial AI threat matrix provides a parallel way to reason about hostile techniques against AI-enabled environments.
Risk and Threat Considerations
Adversaries matter because they turn ordinary control weaknesses into active exposure. The same gap can lead to very different outcomes depending on whether the actor is a low-skill criminal, an insider with existing access, or a well-resourced operator able to persist and adapt.
Failure mechanism: Adversaries exploit weak authentication, excessive privilege, poor segmentation, social engineering, or trust relationships to move from initial access to deeper compromise. Once inside, they can conceal activity, escalate access, and convert one weak point into a broader intrusion path.
Impact: The likely results include data theft, service disruption, fraud, ransomware deployment, surveillance, and long-lived compromise. In high-value environments, the bigger risk is often not the first intrusion but the adversary’s ability to blend in, reuse legitimate access, and avoid detection long enough to reach material assets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | Tactic and Technique Matrix — Adversary Tactics and Techniques | Maps adversary behavior to intrusion techniques and attack paths. |
| Recommendation — Map observed hostile activity to ATT&CK techniques and hunt for credential access, privilege escalation, and lateral movement. | ||
| CIS Controls v8 | CIS-5 — Account Management | Adversaries often abuse accounts and privileges, so account control is central. |
| Recommendation — Restrict and monitor accounts to reduce adversary abuse of valid access. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events | Adversary analysis depends on monitoring for hostile activity and anomalous behavior. |
| Recommendation — Monitor systems for adversary behavior and escalate suspicious activity promptly. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Adversary detection relies on continuous monitoring for malicious activity. |
| AC-6 — Least Privilege | Adversaries seek privilege; least privilege limits what they can do after access. | |
| Recommendation — Use system monitoring to detect adversary actions, anomalies, and indicators of compromise. Apply least privilege so compromised access yields minimal adversary reach. | ||
Related resources from NHI Mgmt Group
- How should security teams stop adversary-in-the-middle attacks on MFA-protected accounts?
- Why do adversary-in-the-middle attacks still work when MFA is enabled?
- How should security teams reduce the risk of adversary-in-the-middle phishing?
- Why do OTP and push approvals fail against adversary-in-the-middle attacks?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org