What is an Advanced Persistent Threat (APT)?

What is an Advanced Persistent Threat (APT)?

Most write-ups on advanced persistent threats stop at the acronym: advanced tools, persistent access, threat to your organisation. That definition is not wrong, but it is not useful either. It tells you nothing about who you are actually up against or what to do about it.

An APT is not a technique. It is an operation, usually run by or on behalf of a state, built around a specific objective: sustained access to a target, not a quick payout. The "advanced" part rarely means exotic malware. It more often means patience, operational security, and a willingness to sit inside a network for months without tripping the alerts that stop opportunistic criminals. The "persistent" part is the actual threat: an operator who gets evicted and comes back with a different foothold is not deterred, they are re-planning.

That distinction matters because it changes what a sensible response looks like. Ransomware crews want to be noticed, that is how they get paid. APT operators want the opposite. Defences tuned for the first group frequently miss the second entirely.

Why attribution changes the answer

"An APT is targeting your sector" is not a complete sentence. Different actors have different objectives, different tradecraft, and different tells, and conflating them is how organisations end up defending against the wrong thing.

For European organisations, the threat picture that matters most is not the one most vendor content defaults to. GRU and FSB-linked operations against critical infrastructure, energy, and logistics; pre-positioning consistent with hybrid and sabotage objectives rather than straightforward espionage; activity tied to the war in Ukraine and its spillover into Baltic and Nordic infrastructure. That is the operating environment for a European organisation today, and it looks different from the China-nexus and financially-motivated activity that dominates most APT coverage.

China-nexus operations remain a real and active concern, particularly for organisations with exposure in Asia or supply chains that run through the region. That is where our partnership with TeamT5, a Taiwan-based research team with deep visibility into the APAC threat landscape, adds coverage we would not otherwise have. We treat it as one input among several rather than the whole picture, fused with our own research and other sources so European buyers get intelligence built for their actual threat model, not a regional feed repackaged for a market it was never built for.

Reading about tactics is not the same as testing against them

Most APT content, including a lot of what used to sit on this page, explains tactics from the outside: here is what lateral movement looks like, here is what a command-and-control channel does. That is descriptive, not diagnostic. It tells you what happened elsewhere. It does not tell you whether it would work against you.

We approach this differently because of where we come from. SAFA is an offensive research house first. When we assess an APT-relevant threat, the question we ask is not just "what did this actor do" but "would this work here, against this environment, today." That is a different exercise, and it is the one that actually reduces risk rather than just raising awareness of it.

In practice, this means threat-informed testing that mirrors real adversary tradecraft rather than a generic penetration test checklist, aligned to the TIBER-EU and DORA threat-led testing frameworks where that alignment is required or useful. For a MOD, NCC, CERT, or a regulated mid-market organisation with NIS2 or DORA obligations, that alignment is not a nice-to-have, it is close to a mandate.

What to do with this

If you take one thing from this: do not treat "APT" as a single threat to defend against. Ask which actor, with what objective, and whether your current defences have actually been tested against that specific tradecraft rather than a generic simulation of it. That is where a conversation with us usually starts.