What is an advanced persistent threat and how do you defend against one?

An advanced persistent threat (APT) is an adversary with sophisticated expertise and significant resources who pursues its objectives repeatedly over a long period, adapting to defenders. The goal is usually a lasting foothold for stealing information or disrupting a mission, not a quick one-off crime. Defense relies on reducing access and detecting slow, quiet activity.

What does the formal definition say?

NIST's glossary, drawing on CNSSI 4009 and several NIST publications, defines an APT as an adversary with sophisticated levels of expertise and significant resources, which lets it use multiple attack vectors, such as cyber, physical and deception, to create opportunities to reach its objectives. Those objectives are typically to establish and extend its presence within an organization's information technology infrastructure to keep exfiltrating information, to undermine or impede critical aspects of a mission or program, or to put itself in a position to do so in the future.

It adds that the APT pursues its objectives repeatedly over an extended period of time, adapts to a defender's efforts to resist it, and is determined to maintain the level of interaction needed to carry them out.

Three words carry the meaning. Advanced: skills and resources. Persistent: it comes back and stays. Threat: a person or group with intent, not just a piece of malware.

How is an APT different from ordinary crime?

A typical criminal campaign sends the same phishing email to thousands of people and moves on if it fails. An APT picks a target, studies it, and keeps trying different ways in. If you close one door, it uses another.

A constructed example, with invented details: a mid-sized engineering firm designs components for a defense supplier. An intruder reads staff profiles, sends a tailored message to one engineer, and gains a login. Over months they use legitimate tools, collect design files in small batches, and stage them on a server before sending them out in traffic that looks like routine uploads. No ransom note appears. The firm learns about it only when a partner reports a leak.

That pattern, low noise and long dwell time, is why alerts alone often fail.

How do you learn what these groups do?

MITRE ATT&CK describes groups as activity clusters tracked by a common name in the security community. Analysts use different methods and terms, such as threat groups, activity groups and threat actors, and some groups have several names for similar activity. Each entry lists the techniques observed, which is useful for planning detection against real behavior.

Two cautions. Naming and attribution are hard and contested, so treat a group label as shorthand for a set of behaviors, not as proof of who is attacking you. And a technique list is a starting point for hunts and tests, not a checklist that guarantees safety.

What does defense look like?

You cannot match a well funded adversary's resources, so aim to raise their cost and shorten their stay.

• Reduce initial access. Patch internet-facing systems quickly, use phishing-resistant multi-factor authentication, and tighten email and remote access.
• Limit privilege. Fewer admin accounts, short lived credentials, and separate accounts for administration.
• Segment. Keep sensitive systems apart so one foothold does not reach them.
• Log and keep logs. Identity, endpoint, network and cloud logs, kept long enough to look back months.
• Hunt. Pick techniques from ATT&CK relevant to your sector and search for them, instead of waiting for alerts.
• Watch the supply chain. Adversaries use trusted software and vendors as a way in. Know your dependencies and vendor access.
• Prepare to evict. A plan to remove an intruder completely, not just the one machine you found, including resetting credentials and keys.

Safeguard's dependency scanning and policy gates address the software supply chain part, and its zero-day discovery work supports spotting unknown flaws earlier, but no single product addresses an APT. The defense is a program.

How to check or apply this

1. List the data and systems an adversary with patience would want most.
2. Enable phishing-resistant multi-factor authentication for admins and remote access first.
3. Reduce standing admin rights and review service accounts.
4. Confirm you keep identity and endpoint logs for at least several months.
5. Choose five ATT&CK techniques relevant to you and test whether you would notice each.
6. Write and rehearse an eviction plan that includes credential and key resets.

Quick check

Sources

• NIST CSRC Glossary, advanced persistent threat
• MITRE ATT&CK, Groups

Last reviewed: 18 October 2026.