Classifying Cybersecurity Threats by Source and Intent

Hello. In the previous lesson, you learned to separate an asset, threat, vulnerability, attack vector, risk, control, and security incident. That vocabulary lets you describe what happened in a security scenario and why it matters.

This lesson adds two useful labels for the source of a threat:

• Is it internal or external to the organisation?
• Is the harmful action intentional or accidental?

By the end, you should be able to classify a scenario accurately, including the more realistic cases where an external attacker and an internal employee are both involved.

---

Two independent classification questions

Do not treat internal/external and intentional/accidental as one scale. They are two separate questions.

1. Origin: What is the relationship of the threat source to the organisation?

   • Internal: comes from someone with authorised access, trusted knowledge, or an established role within the organisation.
   • External: comes from outside the organisation’s trusted boundary.

2. Intent: Did the person mean to carry out the harmful or unauthorised action?

   • Intentional: deliberate misuse, attack, theft, sabotage, or unauthorised access.
   • Accidental: an unintended mistake, loss, or error that creates harm.

This gives a four-part classification matrix:

	Intentional	Accidental
Internal	An employee deliberately copies customer data to sell it.	An employee sends a confidential spreadsheet to the wrong email address.
External	A cybercriminal sends ransomware or attempts password attacks.	A contractor accidentally damages an external network cable, interrupting internet access.

The words describe the role of the source in that scenario, not whether they are physically inside a building. A staff member working from home is still an internal user. A criminal who logs in remotely using stolen credentials is still an external attacker.

---

What counts as an internal threat?

An internal threat, often called an insider threat, arises from someone who has legitimate access to an organisation’s systems, information, premises, or knowledge. This can include employees, managers, administrators, temporary staff, and sometimes contractors or former employees.

CISA’s definition is useful because it makes an important point: insiders can cause harm deliberately or unintentionally.

An insider has advantages that an outsider may not have:

• access to internal systems, folders, applications, or buildings;
• knowledge of procedures and valuable data;
• an existing user account;
• awareness of weak processes or poorly protected assets.

This does not mean every employee is suspicious. It means organisations must protect against mistakes as well as deliberate misuse, rather than relying only on perimeter controls such as firewalls.

The image shows three common insider-related situations:

• Malicious: an employee or trusted user deliberately abuses access, perhaps to steal data or damage systems.
• Negligent: an employee makes an avoidable error, such as losing a device or sending an attachment to the wrong person.
• Compromised: an outside attacker steals or uses an employee’s credentials. The account is internal, but the person controlling it may be external.

That final category is particularly important in exam answers. Seeing an internal username in a log does not prove that an employee intentionally caused the incident.

---

Internal threats: intentional and accidental

Internal and intentional

An internal intentional threat occurs when an insider knowingly carries out an unauthorised or harmful action.

Typical examples include:

• a disgruntled employee deleting important files before leaving;
• an administrator deliberately creating a hidden account;
• a staff member copying client records to a personal drive to sell them;
• an employee sharing confidential information with a competitor;
• a worker deliberately disabling security software so they can install unauthorised programs.

The evidence of intent matters. A distinction-level answer should identify evidence such as deliberate copying, concealment, personal gain, revenge, repeated policy breaches, or an attempt to bypass controls.

For example:

The threat is internal and intentional because the payroll administrator used legitimate access to export employee bank details to a personal storage account. The action was deliberate and unauthorised, creating a confidentiality risk to sensitive personal data.

Internal and accidental

An internal accidental threat happens when a trusted user makes a mistake without intending to harm the organisation.

Examples include:

• choosing the wrong recipient from an email auto-complete list;
• attaching the wrong file;
• losing an unencrypted laptop or USB drive;
• incorrectly setting a shared folder so that everyone can view it;
• clicking a phishing link because the employee believed it was genuine;
• overwriting a file or deleting data by mistake.

Accidental does not necessarily mean harmless or free from consequences. A mistaken email containing student safeguarding information could still be a serious security incident and possibly a personal-data breach. The classification describes the employee’s intent, not the severity of the result.

A useful distinction is:

• Accidental: the employee did not mean to expose information.
• Negligent: the employee may have ignored training or procedures, increasing the chance of an accident.

In an exam scenario, use the evidence given. If the scenario only says an employee sent data to the wrong address, classify it as accidental. If it says they knowingly ignored a clear rule and used an unapproved personal cloud service, explain the nuance:

The employee deliberately used an unauthorised service, but the exposure of data may have been unintended. This is an internal policy breach that created an accidental data-disclosure risk.

---

External threats: deliberate attacks and external mistakes

An external threat originates outside the organisation’s trusted boundary. Usually, it is an individual or group trying to gain unauthorised access through the internet, email, public Wi-Fi, physical entry, or a supplier connection.

External and intentional

Most cyberattacks described in BTEC scenarios are external and intentional. Examples include:

• cybercriminals sending phishing emails;
• ransomware groups encrypting an organisation’s files and demanding payment;
• attackers guessing passwords or using stolen credentials;
• a botnet carrying out a denial-of-service attack against a website;
• a competitor attempting corporate espionage;
• an attacker exploiting an unpatched web server.

The attacker is external even if they successfully obtain an internal account. Their use of a valid username is an unauthorised access incident, not proof that the legitimate employee is malicious.

External and accidental

External accidental threats are less common in cybercrime scenarios, but they are possible. They include events outside the organisation’s control that unintentionally affect confidentiality, integrity, or availability.

For example:

• external construction work accidentally cuts a network cable;
• a power supplier fault interrupts a data centre;
• a visitor accidentally damages network equipment;
• a third party unintentionally sends confidential information to the organisation’s public email address;
• a supplier error affects a service on which the organisation relies.

Whether a contractor or supplier should be called internal or external can depend on the organisation’s security boundary. A contractor given authorised access to internal systems may be treated as an insider for security purposes. In a scenario answer, state your assumption clearly and use the evidence provided.

---

One incident can involve more than one classification

Real incidents often involve more than one person. Therefore, avoid forcing the entire situation into one label.

Consider this scenario:

A staff member at a college receives an email that appears to be from the IT department. Believing it is genuine, they enter their password into a fake login page. A cybercriminal uses the password to access the staff member’s account and downloads student records.

There are at least four elements:

Scenario element	Accurate classification
Cybercriminal	External and intentional threat actor
Staff member entering credentials	Internal and accidental action
Fake login email and website	Phishing attack vector
Download of student records	Security incident involving unauthorised access and possible data breach

A strong written answer would be:

The cybercriminal is an external, intentional threat actor because they deliberately used a phishing website to obtain credentials and access student records without permission. The staff member’s action is internal and accidental because they believed the email was genuine. The phishing email is the attack vector, while the successful download of records is a security incident.

Notice how this builds directly on the previous lesson:

• Threat actor: external cybercriminal
• Vulnerability: staff susceptibility to phishing and lack of multi-factor authentication
• Attack vector: fake email and website
• Incident: unauthorised account access and data download

---

Incident categories can overlap

The NCSC guidance shows that incident categories are not always mutually exclusive. A single incident could be phishing, unauthorised access, an insider-related event, and a data breach at the same time.

For example, an employee may accidentally send confidential data externally:

• Source: internal employee
• Intent: accidental
• Incident category: data breach
• Asset affected: confidential customer information
• Impact: loss of confidentiality, reputational harm, and potential legal consequences

The same data breach could instead result from an external attacker stealing the information. The incident category is similar, but the threat source and the controls needed may differ.

---

A reliable classification method

When you see a scenario, use this sequence.

1. Identify each person or source separately

Look for:

• employees, administrators, contractors, former staff;
• unknown attackers, criminals, competitors, hackers;
• suppliers, visitors, utilities, or physical events;
• malware or compromised accounts.

Do not assume there is only one source.

2. Decide whether each source is internal or external

Ask:

Did this source have legitimate authorised access or trusted organisational knowledge before the incident?

If yes, it is likely internal. If it is an outsider attempting to enter through public-facing systems, it is external.

3. Look for evidence of intent

Evidence in a scenario	Likely interpretation
Deliberately copied files, disabled logs, demanded money, used a stolen password, installed malware	Intentional
Wrong recipient, lost device, typing mistake, incorrect configuration, believed phishing email was genuine	Accidental
Ignored a known policy or warning	Explain that the action may be deliberate, while the resulting harm may still be unintended

4. State the classification and justify it

Use this sentence structure:

This is an internal/external and intentional/accidental threat because [scenario evidence]. It could affect [asset] by [likely consequence].

For example:

This is an internal, accidental threat because the employee mistakenly made a confidential folder publicly accessible. It could expose customer records, damaging confidentiality and creating a data-protection risk.

Or:

This is an external, intentional threat because a criminal is attempting to use password-guessing software against a public login page. A successful attack could allow unauthorised access to customer accounts.

---

Common mistakes to avoid

Mistake	Better reasoning
“Anyone working remotely is an external threat.”	Remote location does not decide the classification. A staff member working from home remains internal.
“A compromised employee account proves an employee was malicious.”	The account is internal, but the person using it may be an external attacker.
“Phishing is an internal threat because an employee clicked it.”	The phishing actor is usually external and intentional; the employee’s click may be internal and accidental.
“Accidental means the incident is low severity.”	An accidental disclosure can still have major legal, financial, and reputational consequences.
“An insider threat must be malicious.”	Insiders can cause harm intentionally, negligently, or accidentally.
“The data breach is the threat actor.”	A data breach is an incident or outcome. Identify the person or source that caused it separately.

For a concise but high-quality BTEC response, always support your classification with evidence from the scenario. The marker needs to see not only the label, but also your reasoning.

---

Key takeaways

• Internal and external describe the threat source’s relationship to the organisation, not their physical location.
• Intentional and accidental describe whether harmful or unauthorised action was deliberate.
• An insider may be malicious, negligent, accidental, or compromised by an outsider.
• One incident can involve several classifications: for example, an external intentional attacker and an internal accidental employee action.
• Keep the threat actor separate from the attack vector and incident:
  • criminal = threat actor;
  • phishing email = attack vector;
  • stolen data = security incident or breach.
• Strong scenario answers name the classification, quote the scenario evidence, and explain the likely effect on an asset.

Next, you will focus on the practical harm that staff actions can cause: employee sabotage, theft, unauthorised access, and accidental disclosure.