What it means
Common motivations include financial gain, espionage, disruption, ideology, personal grievance, competitive advantage, and curiosity. Categories are useful starting points, not proof of attribution.
Why it matters
Understanding plausible motivation helps defenders prioritize scenarios and interpret behavior without assuming every incident has the same objective.
Practical focus
- Connect actor behavior to assets and business context
- Distinguish capability from intent
- Use confidence levels when discussing attribution
- Update assumptions as new evidence appears
Common mistakes
- Treating labels as precise identities
- Attributing from one tool or indicator
- Ignoring insiders and trusted third parties
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: