APT (Advanced Persistent Threat)

security

An adversary with the resources and patience to gain access and keep it - typically state-sponsored or state-tolerated, focused on collection over months or years rather than on immediate gain. The term describes the operator's posture, not a specific technique.

The phrase came out of US Air Force reporting in the 2000s and hardened into an industry label after Moonlight Maze and Titan Rain. Each word does work: advanced means capable of building tools rather than only buying them, persistent means it comes back after you evict it, threat means a human with intent rather than an automated scan. It is also the field's most abused term - vendors call ordinary criminal crews APTs because it sells, and the correct question about any intrusion is whether the operator will still be trying next quarter.

Also known as: advanced persistent threat, apt group, state-sponsored actor

← All glossary entries