Actor Characteristics in Threat Modeling: Evaluating Resources Like Time and Money

When a threat modeling workshop says an attacker has “time and money,” that is not a vague assumption. It is a shortcut for estimating how much pressure an adversary can sustain, how much stealth they can buy, and how much effort they can put into bypassing controls. For GRC teams, that matters because Resources drive risk decisions, control selection, and residual risk acceptance.

That distinction is central to the course Compliance in The IT Landscape: IT’s Role in Maintaining Compliance, because compliance teams need to understand which threats are realistic, which controls are justified, and where audit evidence should show an informed risk decision.

Primary focus	Actor characteristics in threat modeling, especially time and money as adversary Resources
Main use	Estimate attacker capability, persistence, and likely attack complexity
Best paired with	Risk Management, Threat Modeling, and threat intelligence
Key variables	Time, money, skill, access, intent, and target value
Practical outcome	Better prioritization of controls, monitoring, and incident response planning
Common high-risk pattern	Long-duration, well-funded campaigns that combine stealth, adaptation, and persistence

Why Time and Money Matter in Threat Modeling

Time and money matter because they directly shape attacker capability. A threat actor with limited time and budget usually chooses fast, repeatable methods such as credential stuffing, mass phishing, or scanning for unpatched services. A threat actor with more Resources can spend days or months on reconnaissance, payload customization, infrastructure changes, and stealth.

That difference changes the threat model. A low-effort attacker may fail if basic controls are in place, but a resourced attacker may adapt, retry, or shift tactics until they find a weak spot. This is why resource-based analysis is more than a theory exercise; it affects risk treatment decisions, control depth, and response readiness.

Threat models are most useful when they describe what an adversary can afford to do, not just what the adversary wants to do.

Time also signals patience. Some actors want quick results and will abandon a target after the first obstacle. Others are willing to wait for staff turnover, holiday periods, cloud migrations, or a rushed change window. Money signals endurance. A financially supported adversary can replace infrastructure, buy services, and keep a campaign alive after partial detection.

For governance teams, this means risk is not just about “can they attack us?” It is also about “how long can they keep trying, and what can they pay to improve their odds?” That question belongs in every serious threat modeling session, especially when a regulated asset, customer data store, or critical identity platform is involved.

Official guidance from NIST Cybersecurity Framework and the CISA resources library both reinforce the value of treating risk as a combination of likelihood and impact, which is exactly where attacker capability belongs.

How Does Threat Actor Resource Analysis Work?

Threat actor resource analysis works by estimating what an attacker can realistically sustain over time. The point is not to guess the exact budget line. The point is to classify the adversary into a practical capability tier and then align controls to that tier.

1. Identify the actor profile. Start with what is known about the attacker’s motivation, target selection, and typical campaign style. A commodity fraud group does not usually behave like a state-aligned intrusion team.
2. Estimate financial capacity. Ask what infrastructure, services, or labor the adversary can plausibly buy. That includes cloud hosting, proxy services, phishing kits, or developer help.
3. Estimate time horizon. Determine whether the attack is likely to be opportunistic, multi-stage, or long-term. A patient actor can wait for a better opening and revisit targets after failed attempts.
4. Map capability to tactics. Decide whether the attacker is likely to rely on public exploits, custom malware, social engineering, or a mixture of methods.
5. Adjust assumptions with evidence. Compare your estimates with known campaigns, incident reports, and sector-specific intelligence. Update the model when reality proves your assumptions wrong.

This approach is practical because time and money often show up in observable behavior. Rapid spray-and-pray attacks suggest limited patience and modest investment. Longer, more disciplined campaigns suggest planning, resourcing, and operational support.

Vendor guidance from Microsoft Security and Cisco Security regularly shows how adversaries blend persistence, infrastructure changes, and identity abuse when they have the budget and time to do it. Those patterns are useful because they turn abstract “actor capability” into concrete defensive expectations.

What Are the Key Components of Adversary Resources?

Adversary Resources are not just money in a bank account or hours on a calendar. They are the set of conditions that determine whether an attacker can execute, sustain, and adapt a campaign. In a threat model, the most useful components are the ones that change attack feasibility.

• Financial capacity — the ability to pay for hosting, tooling, contractors, and anonymity services.
• Operational time — the ability to conduct reconnaissance, stage access, and wait for the right moment.
• Infrastructure flexibility — the ability to rotate domains, IPs, cloud instances, and command channels.
• Skill acquisition — the ability to hire or rent expertise instead of building every capability internally.
• Persistence budget — the ability to absorb detection, failures, and infrastructure loss without ending the campaign.
• Automation capacity — the ability to scale attacks through scripts, bots, and commodity platforms.

These components interact. Money without patience can still produce a noisy campaign. Time without money can still be dangerous if the attacker uses public tools and weak controls are exposed. The highest-risk profile is usually the combination of both.

For organizations subject to ISO/IEC 27001 or NIST SP 800-30 style risk processes, these components help translate qualitative threat language into a repeatable assessment. That is useful when documenting risk registers, audit narratives, and control exceptions.

How Do Financial Resources Change Attack Sophistication?

Financial resources let attackers do things that low-budget actors usually cannot. Money buys custom development, premium infrastructure, and time-saving services. It also buys retries. If a phishing domain is burned or a server is blocked, a funded adversary can rebuild quickly and keep going.

That changes sophistication in visible ways. A low-budget attacker may use commodity malware with obvious signatures. A better-funded attacker may use modified payloads, unique staging infrastructure, and layered access methods. The attack still may fail, but it will often take more effort to detect and more time to contain.

• Custom malware can evade generic detections and be tuned for a specific environment.
• Proxy and hosting services help hide origin and rotate infrastructure after blocking.
• Purchased access can accelerate intrusion by skipping the initial compromise phase.
• Specialized labor allows an actor to outsource phishing, development, or persistence work.

Well-funded criminal groups and state-aligned operators are also more likely to invest in false identities, domain age, certificate abuse, and post-exploitation discipline. That does not make them unstoppable, but it does make them more resourceful and harder to catch with one-layer defenses.

Money does not guarantee success, but it raises the number of ways an attacker can try to succeed.

For context, Verizon Data Breach Investigations Report and IBM Cost of a Data Breach reports consistently show that credential misuse, social engineering, and multi-stage intrusion patterns remain common. That is a strong reminder that financially supported campaigns often blend cheap initial access with more expensive follow-through.

How Does Money Expand Persistence and Operational Resilience?

Operational resilience is the ability to keep a campaign alive after setbacks. Money improves that ability in a direct way. A well-funded attacker can lose servers, domains, accounts, or proxies and still continue the operation.

That matters because defenders often focus on removal of one malicious asset. A low-resource attacker may collapse when a single infrastructure node is taken down. A funded attacker can shift to another node, rotate channels, or rebuild the attack chain with little delay.

1. Infrastructure replacement keeps the campaign moving when a domain or IP is blocked.
2. Redundant command-and-control channels reduce the chance that one detection ends the intrusion.
3. Repeated access attempts give the attacker more chances to catch a weak password reset, a missed alert, or an exposed service.
4. Longer dwell time increases the odds of privilege escalation, data access, or lateral movement.

That persistence changes the defender’s workload. Incident response is no longer a one-and-done cleanup task. It becomes a cycle of containment, eradication, validation, and re-monitoring. If the attacker has enough money, the campaign may shift targets across regions, subsidiaries, or cloud tenants while defenders are still cleaning up the first intrusion.

MITRE ATT&CK is especially useful here because it maps the stages of post-compromise behavior. A resource-rich attacker usually leaves a broader trail of TTPs, but they may also be more disciplined about hiding them. That is one reason sustained monitoring and hunting are part of the control strategy, not optional extras.

How Does Time Shape Reconnaissance and Attack Maturity?

Time lets attackers learn. The longer an adversary studies a target, the more likely they are to find weak points in users, applications, cloud settings, or business processes. Time is often the difference between a blind attack and a well-timed one.

In practice, time supports reconnaissance, testing, and sequencing. A patient actor may map public-facing assets, identify identity providers, observe email patterns, and wait for maintenance windows. That preparation improves attack maturity because the campaign is no longer generic. It is tailored.

• Reconnaissance can reveal exposed systems, vendors, and trust relationships.
• Timing analysis can identify holidays, shift changes, or change freezes.
• Payload tuning can reduce noisy behavior that would trigger alerts.
• Phishing refinement can increase the odds of user interaction.

Fast, smash-and-grab attacks tend to be broad and shallow. Patient attacks tend to be narrower and deeper. That distinction matters because a quick attempt may be stopped by basic filtering, while a patient attack may succeed only after multiple small steps that look harmless on their own.

For organizations aligned to the NIST threat modeling guidance and OWASP security practices, this is the reason recon, staging, and user behavior analysis belong in the threat model. Time is a tool, not just a calendar entry.

How Does Time Support Iteration and Evasion?

Iteration is what happens when an attacker learns from each attempt and adjusts the next one. Time makes iteration possible. Without time, the attacker is stuck with the first tactic. With time, the attacker can refine the attack until it fits the environment better.

This is one of the clearest signs of a serious adversary. A campaign that changes phishing language after filters block it, or shifts from direct login attempts to OAuth abuse or help desk social engineering, is demonstrating operational learning. That learning often comes from observing defender behavior.

1. Test a method. The attacker tries a lure, login attempt, or payload delivery path.
2. Observe the response. Defensive controls, user reactions, and logging outcomes reveal what worked and what failed.
3. Modify the approach. The attacker changes the content, source, timing, or delivery path.
4. Repeat at scale. If the modified version succeeds, the actor expands the campaign.

That process is one reason why basic awareness training alone is not enough. A skilled and patient adversary will test user habits, mailbox protections, identity controls, and network segmentation. If they fail in one place, they shift to another. The more time they have, the more complete that experimentation becomes.

These dynamics are visible in many breach reports and threat intelligence updates from SANS Institute and CrowdStrike. The consistent theme is simple: attackers that can learn from your defenses are more dangerous than attackers that cannot.

What Happens When Time and Money Combine?

Time plus money is the most concerning combination in threat modeling because it creates patience with options. The attacker can wait, pay, test, and retry. That combination raises the likelihood of a successful intrusion and the expected damage if the intrusion succeeds.

Resource-rich actors can run long-term campaigns with custom tooling, specialized operators, and flexible infrastructure. They can also preserve operational secrecy by limiting noise and spreading activity over longer periods. That makes detection harder because the activity may look like ordinary business traffic, a small number of user mistakes, or isolated authentication problems.

Time only	Allows patience, repeated observation, and timing-based abuse, but usually depends on cheap or public tools.
Money only	Allows tooling, infrastructure, and outsourcing, but the campaign may still be rushed or poorly timed.
Time plus money	Enables persistent, adaptive, and stealthy campaigns that can survive setbacks and refine tactics.

That combination changes how organizations should think about loss. If the likely adversary can keep trying, then response plans need to assume more than a single event. They need to assume re-entry attempts, infrastructure rotation, and eventual pressure on multiple controls.

ISACA COBIT and AICPA SOC reporting guidance are helpful reference points here because they reinforce the need for governance, control accountability, and documented risk treatment. Resource-rich adversaries make those practices more important, not less.

How Do You Evaluate Actor Resources in Real-World Threat Modeling?

Evaluating actor Resources starts with a few practical questions. What kind of target is this? What is the attacker trying to gain? How much effort would be justified by the expected reward? Those questions help determine whether the actor is likely to be opportunistic, organized, or highly capable.

Use evidence, not guesswork. Sector-specific incidents, known campaigns, and threat intelligence should shape the conclusion. A customer portal with weak MFA may attract opportunistic fraud. A regulated identity provider or payment system may attract better-funded and more patient actors.

1. Assess target value. High-value targets justify more attacker investment.
2. Review likely motivation. Financial gain, espionage, disruption, and extortion tend to imply different resource levels.
3. Check campaign history. Repeated targeting by the same type of actor suggests persistent interest and capability.
4. Classify likely tempo. Fast attack, medium-duration campaign, or long-haul intrusion?
5. Document confidence. State whether your conclusion is high, medium, or low confidence and why.

Analysts often improve judgment by comparing local incidents with published findings from the U.S. Bureau of Labor Statistics Occupational Outlook Handbook for labor market context and with vendor threat reports that show how campaigns evolve over time. The labor data is not about attacker budgets, but it is useful when planning organizational staffing and defensive maturity around real-world demand for security talent.

For repeatable governance, the key is to make each resource judgment auditable. If your model says an attacker is low-resourced, write down the evidence. If your model says the adversary is patient and well-funded, document the signs that support that conclusion. That discipline helps during audits, tabletop exercises, and after-action reviews.

What Are the Best Methods for Estimating Time and Money?

Estimating Time and money is partly art and partly evidence gathering. You usually will not know the attacker’s real budget, but you can estimate the budget band by observing how they behave. The more sophisticated the infrastructure and the longer the campaign, the more likely the actor has meaningful Resources.

Start with threat intelligence and breach reports. Then compare those reports to what you observe in logs, alerts, and attack paths. A campaign that uses multiple domains, frequent infrastructure rotation, and carefully timed lures suggests more investment than a single spam blast.

• Threat intelligence feeds can reveal known infrastructure, TTPs, and repeated campaign patterns.
• Breach reports can show how similar actors got initial access and how long they stayed hidden.
• Attack path analysis shows how many steps were required to reach the asset.
• Business impact assessment helps judge whether the target is worth the effort to the attacker.
• Observed adaptation is one of the strongest clues that the adversary has both time and money to iterate.

Technical references such as CIS Benchmarks and OWASP Top 10 are also useful because they help you estimate how much attacker effort may be needed to exploit common weaknesses. If the environment is hardened to baseline standards, lower-effort attacks become less plausible.

One practical habit improves consistency: assign a confidence level to every estimate. For example, “medium confidence that this actor has moderate funding based on infrastructure rotation and multi-stage delivery.” That keeps resource analysis from turning into unsupported opinion.

What Mitigations Work Against Resource-Rich Adversaries?

Mitigation against resource-rich adversaries depends on making repeated success difficult and expensive. That means layered controls, identity protection, segmented networks, and strong monitoring. The goal is not to assume the attacker will quit. The goal is to reduce their return on investment.

Start with the basics and make them hard to bypass. Strong MFA, least privilege, patch discipline, network segmentation, and endpoint detection are still foundational. But for a patient, funded actor, those controls need support from alert triage, hunting, and containment procedures that can operate under pressure.

• Identity security reduces credential abuse and token theft opportunities.
• Segmentation limits lateral movement and reduces blast radius.
• Behavioral analytics helps catch stealthy account abuse and unusual access patterns.
• Threat hunting helps identify slow, low-and-slow intrusions that alerts miss.
• Incident response readiness shortens dwell time and limits repeated compromise.

Defense also needs speed. If the adversary can rapidly replace infrastructure, your response process cannot be slow and manual. Automate log retention, alert enrichment, account disablement, and isolation steps where appropriate. That shortens the window in which the attacker can use their Resources effectively.

Organizations that track controls against frameworks like NIST CSF and PCI Security Standards Council guidance are usually better positioned to show that they reduced attacker ROI in a defensible, audit-ready way.

How Can GRC Programs Use Actor Resource Analysis?

GRC programs use actor resource analysis to justify priorities. If the model says the most plausible attacker has limited time and budget, the control plan may emphasize hardening, automation, and quick detection. If the model says the attacker is well-funded and patient, governance should support deeper monitoring, stricter access, and stronger response capability.

This is where threat modeling stops being a technical exercise and becomes a management tool. Resource-based assumptions feed the risk register, control mapping, remediation planning, and residual risk acceptance. They also help explain why one asset gets more investment than another.

1. Map the resource profile to the risk register. Record whether the adversary is likely to be low, medium, or high resource.
2. Link controls to risk treatment. Show which safeguards address persistence, stealth, or repeated attempts.
3. Document residual risk. Note what remains after controls are applied and why that level is acceptable or not.
4. Use evidence for budget decisions. Fund the controls that reduce the most realistic threat scenarios.

That approach fits well with compliance reporting because it creates a traceable line from threat assumption to control action. It also supports board-level discussions. Leaders do not need to know every TTP, but they do need to know why a certain threat profile justifies a certain budget request.

For formal governance, reference points such as CISA and HHS HIPAA guidance can help organizations align security controls with regulated data protection expectations. The same logic applies across sectors: better threat assumptions produce better control decisions.

What Are the Common Mistakes When Assessing Time and Money?

The most common mistake is treating every attacker as if they have the same Resources. That is wrong in both directions. Some adversaries are sloppy and cheap. Others are organized, patient, and well-supported. If you flatten those differences, your controls will miss the mark.

Another mistake is overconfidence. A single phishing email does not prove low sophistication, and a single custom domain does not prove high capability. The right answer comes from patterns, not one-off observations.

• Ignoring patience and focusing only on tools.
• Assuming low budget because the attacker used commodity malware.
• Assuming high budget because the attack looked polished.
• Failing to update assumptions after a new campaign or incident.
• Leaving confidence levels unstated so the model looks more certain than it is.

It is also easy to mistake “noisy” for “low risk.” A noisy adversary may still cause serious damage if your defenses are weak. Likewise, a patient adversary may look harmless until they have already achieved persistence. Both cases matter, but the response should match the evidence.

Good threat modeling balances realism and uncertainty. If the evidence is thin, say so. If the resource estimate is strong, explain why. That discipline improves auditability and keeps the model useful when the next incident forces a reassessment.

When Should You Use Resource-Based Threat Analysis?

Use resource-based threat analysis when the asset is important enough that attacker effort could change the outcome. That includes identity systems, regulated data stores, internet-facing services, payment environments, and internal platforms that would be expensive to recover if compromised.

It is especially useful when the organization needs to choose between several controls and cannot fund everything. In that case, understanding whether the likely attacker is a casual opportunist or a persistent operator helps prioritize the right work. It is also useful when a sector faces known targeting patterns or repeated campaigns.

When to use it

• During risk assessments for high-value systems.
• When deciding how much resilience a control stack needs.
• When comparing likely attacker classes across business units.
• Before major changes such as cloud migration, M&A, or identity consolidation.

When not to overuse it

• For low-impact systems where a full adversary analysis adds little value.
• When evidence is too weak to support a meaningful estimate.
• When the team starts treating guesses as facts.

This is a practical judgment tool, not a prediction engine. It works best when combined with asset criticality, exposure, and known threat behavior. That is the same kind of disciplined analysis emphasized in the DHS cybersecurity resources and the NIST risk publications used by many compliance teams.

Used well, Resources analysis keeps threat modeling grounded. It prevents wasted spending on unlikely scenarios and helps organizations focus on the attacks that are most capable of adapting, persisting, and succeeding.

Resources are one of the most important clues in threat modeling because they reveal what an attacker can sustain, not just what they want to attempt. Time drives reconnaissance, refinement, and patience. Money drives infrastructure, tooling, outsourcing, and resilience. Together, they define how hard an adversary is to stop and how much damage they can do if they get in.

For GRC teams, the practical lesson is straightforward: do not assess threats in the abstract. Evaluate the adversary’s likely Resources, document your assumptions, and align controls to the real level of risk. That makes prioritization cleaner, audits easier, and response plans more credible.

If you want to improve that skill across your team, the Compliance in The IT Landscape: IT’s Role in Maintaining Compliance course is a good fit because it connects control design, compliance evidence, and risk-based decision-making in one workflow.

CompTIA®, Microsoft®, Cisco®, AWS®, ISC2®, ISACA®, PMI®, and EC-Council® are trademarks of their respective owners.