What Is Advanced Persistent Threat?

An advanced persistent threat is an adversary that pursues a specific objective over a long period, adapting when blocked rather than moving to an easier target. The defining trait is persistence of intent, not technical sophistication.

The term is widely overused. Most intrusions are opportunistic and commercially motivated, and describing them this way inflates the threat while excusing the ordinary failures that enabled them.

What actually distinguishes one

It is targeting you specifically, for a reason connected to what you hold or who you work with. It has time, so an initial failure produces a different approach rather than a lost interest.

It has resources, including the ability to develop capability if bought tooling fails. And its objective is usually access and information over time rather than an immediate payout, which changes how it behaves once inside.

The techniques are frequently ordinary

Initial access is commonly phishing or a stolen credential. Movement uses legitimate administrative tooling. Persistence uses documented platform features. Novel exploitation is used sparingly, because it is expensive and burns the capability once observed.

Which means the defences are the ordinary ones executed well. Phishing-resistant authentication, patching, privileged access control, segmentation and detection coverage all apply, and there is no separate category of product that addresses this.

Dwell time is the differentiator

Commercially motivated intrusions monetise quickly. A targeted adversary may remain for months or years, deliberately quiet, collecting rather than disrupting.

That makes log retention decisive. An intrusion present for eight months cannot be scoped from thirty days of logs, and the organisation cannot then state honestly what was accessed. See security logging.

Eradication is harder than it looks

A patient adversary establishes several independent persistence mechanisms precisely because they expect some to be found. Removing the one that was detected leaves the others.

That is why these responses generally require full scoping before any remediation, and frequently a coordinated cutover rather than incremental cleanup — acting on part of the footprint alerts the adversary to consolidate the rest.

Whether it applies to you

Organisations holding intellectual property, operating critical infrastructure, serving government, or sitting in the supply chain of any of those are realistic targets. So are those whose clients are targets, because the route runs through suppliers.

For everyone else, the honest position is that the ordinary commercial threat is the one that will cause the incident, and investment should reflect that rather than the more dramatic possibility.

Intelligence sharing matters more here than elsewhere

A targeted adversary usually pursues several organisations in the same sector or supply chain, which means peers are frequently facing the same techniques at the same time. Indicators and technique observations shared through a sector community arrive with the relevance that broad commercial feeds lack.

It also changes the response calculation. Discovering a targeted intrusion is a reason to ask which partners and suppliers may be affected, and to consider law enforcement engagement — both of which are decisions better made against a prepared position than invented during the incident.

Where to start

Check your log retention against a realistic dwell time. If it is thirty or ninety days, a patient intrusion is not something you could scope even after detecting it.

See detection, prevention and response. GuardsArm delivers threat intelligence.