Threat actors: Nation-states (sophisticated, patient, espionage/sabotage), Cybercriminals (financially motivated, ransomware/fraud), Hacktivists (ideologically motivated), Insiders, Script kiddies (low skill).
Match controls to threat actor capability. Script kiddies stopped by basic patching/MFA. Nation-states require comprehensive defense-in-depth, threat hunting, and incident response capability. Know your threat actors to prioritize defenses.