Motivations, shadow IT, and the threat that already has a badge

Objective 2.1 in this course covers threat actors and motivations. The previous lesson took the actors; this one takes the motivations in CompTIA's scope note for it — data exfiltration, espionage, financial gain and the rest — together with shadow IT and the insider threat, which are the two entries on CompTIA's actor list that are not really attackers in the usual sense.

Why this matters

Motivation is not colour. It changes the incident. Two intrusions using identical techniques demand different responses if one is after money and the other is after silence, because the money one ends when they are paid or blocked, and the silent one is still there.

Shadow IT and the insider are also the two places where "the attacker" is someone with a valid badge, and the controls that work are almost entirely different from the ones that work on an external attacker.

The lesson

Data exfiltration, espionage, service disruption, blackmail and financial gain

CompTIA's motivation list, each with what it implies for the defender:

• Data exfiltration — taking data out. The tell is volume and destination: large transfers, unusual protocols, cloud storage nobody approved, DNS or HTTPS tunnels. The control is DLP and egress monitoring (Domain 4).
• Espionage — obtaining information for strategic or commercial advantage, quietly and over a long time. Detection is the whole problem, because there is no disruption to notice.
• Service disruption — making things stop. DDoS, wipers, ransomware without a payment path. Availability controls answer it.
• Blackmail and extortion — ransomware, or the modern "we already have your data and will publish it" variant, which makes backups a partial defence only.
• Financial gain — theft, fraud, cryptomining, business email compromise. This is the most common motivation by volume, by a wide margin.
• Philosophical or political beliefs — hacktivism.
• Ethical — the researcher or bug-bounty hunter, who reports rather than exploits. CompTIA lists it because "was the activity malicious?" is a real triage question.
• Revenge — usually an insider or a former insider, usually destructive, usually shortly after a grievance such as a termination or a passed-over promotion.
• Disruption/chaos — damage for its own sake, without a further goal.
• War — state-directed activity as part of a conflict.

Philosophical or political beliefs, ethical motivation, revenge, disruption, chaos

Four of the above deserve a closer look because they behave differently from "attacker wants money".

Philosophical or political beliefs produce attacks aimed at an audience. The target is chosen for what it symbolises, the timing is chosen for a news cycle, and the result is publicised. Defensively this means your risk rises when your organisation is in the news, which is a planning input rather than a technical one.

Ethical motivation is the one people forget exists. Unexpected scanning and probing from an identifiable source, followed by an email, is likely a researcher. Organisations that have no route for that person to report — no security.txt, no disclosure policy, no bug bounty — reliably turn a free finding into a public one. Domain 4's vulnerability management lesson covers setting that up.

Revenge is the motivation with the sharpest timeline. The dangerous window is around a grievance: notice period, disciplinary process, redundancy announcement. This is precisely why offboarding is a security process rather than an HR one, and why access is revoked at the moment someone is told rather than at the end of their notice.

Disruption/chaos matters because it breaks the assumption that attackers are rational actors you can price out. There is no ransom to negotiate and no data to trade. Recovery capability — backups, restore testing, continuity — is the only real answer, and that is Domain 3.

War, and why it changes the risk calculation rather than the controls

CompTIA lists war as a motivation, and the honest framing is this: war does not introduce new techniques. The malware used in state conflict looks much like other malware.

What it changes is who is in scope. In peacetime a small logistics firm is unlikely to be targeted by a state actor. In a conflict involving its customers, it may be — not because anyone cares about the firm, but because it is a supplier to something that matters, or because destructive malware released at an intended target spreads past it. Collateral damage from state-level destructive attacks has repeatedly been the single largest loss event for organisations that were never targets.

For the exam: war raises the likelihood of high-capability attackers reaching organisations that would otherwise be out of scope, and raises the weight of resilience controls relative to prevention.

Shadow IT: unapproved SaaS, personal devices and the reason people reach for them

Shadow IT is technology in use by the organisation without IT or security approval — a team's own project-tracking SaaS, a personal cloud drive holding work files, an unauthorised wireless access point, a departmental database on someone's desktop, an API key in a personal account.

CompTIA lists it as a threat actor, which is jarring until you notice it is the only entry with no malicious intent. People reach for shadow IT because the sanctioned option is slow, missing, or unusable. That is the important part: it is a symptom of a service failure as much as a security problem.

The risk it creates is concrete:

• data in places with no backup, no retention policy and no legal hold;
• no visibility — it does not appear in monitoring, scanning or the asset inventory, so the vulnerability management programme in Domain 4 has no idea it exists;
• access that survives offboarding, because nobody knows the account is there;
• unmanaged third-party risk, since nobody assessed the vendor (Domain 5).

The controls are discovery and alternatives, in that order: find it with CASB, DNS logs, egress monitoring and expense records, then provide a sanctioned option that is actually good enough. Prohibition alone reliably fails, and an exam option that offers "block all cloud services" as the complete answer is the weaker choice against one that pairs discovery with a supported alternative.

Why motivation changes the response even when the technique is identical

Two intrusions, both beginning with a phishing email and a stolen credential.

In the first, the motivation is financial gain. The attacker will cash out quickly. Response priorities are containment and speed: revoke, reset, block the payment path, notify the bank. Once the route is closed the attacker generally leaves, because their economics say so.

In the second, the motivation is espionage. The attacker intends to stay. Responding quickly and visibly is actively counterproductive: you evict one foothold, they use the second one you have not found, and now they know you are looking. The correct response is to scope the full extent of the compromise quietly, then remediate everything at once.

That difference — contain immediately versus scope before you act — is the most decision-relevant thing motivation tells you, and it is where Domain 2's attacker material connects to Domain 4's incident response.

Motivation also drives what you must report. Blackmail and exfiltration bring regulatory notification duties and legal hold obligations that disruption alone may not, which is Domain 5's territory.

What to take into the exam

• Financial gain is the most common motivation; espionage is the one that changes the response.
• Revenge clusters around grievances, which is why offboarding revokes access at the moment of notification.
• Shadow IT has no malicious intent and is a symptom of an unmet need. Answer it with discovery plus a sanctioned alternative, not prohibition alone.
• Ethical motivation is real — have a disclosure route, or researchers become public disclosures.
• War changes who is in scope and raises the value of resilience; it does not change the techniques.