My feelings after working in computer security on the risk modelling side is that we put too much focus on threat actors. I don't have anything resembling a precise definition of the problem, just rough impression. But IME, you start doing these threat scenarios in form [Actor] does [Action] to [Asset] and then [Consequences] happen, and you start noticing that:

- The sets of [Actor] and [Action] are fuzzy and nearly unbounded, and you have to shoehorn them into weird taxonomies to have something you can work with. And then you're still left with lots of overlapping scenarios; it's hard to make them independent in statistical sense, to be able to treat them as separate contributions to the risk calculation.

- Everything pivots around [Assets]. Not around [Consequences], because these are affected by a particular [Actor] and [Action]. I.e. it's a different kind of PR disaster if your DB leaked because of a careless employee, vs. NSA tapping your internal data center links. But [Assets] are ultimately what attackers are after, and what costs you money if something happens to them.

So you end up with a huge list of scenarios like "Russian hacktivists zero-day Windows machines and steal customer PII, leading to EU dropping a hammer", or "Norwegian state-sponsored script kiddies SQL-inject company webpage and steal customer PII of North Americans, leading to bad press", etc., and you can see how the only thing you can reasonably enumerate here is what was damaged (stolen PII). It's also the assets that motivate most attacks and that are the primary source of consequences (from outages to fines and bad press).

This leads me to the conclusion that it may be more productive to focus on what assets do you have, what can go wrong with any of them, and how much it would cost (without taking into account who the attacker was). You could go from there and expand into likely threat actors, but I'm not really convinced it's productive. I didn't try to verify it, but it might be more useful to just stick to assets and baseline losses, fortify any kind of access anyone has to these assets, and mostly ignore the various kinds of threat actors that might be involved. Instead of trying to distinguish between Russian hacktivists and Norwegian state-sponsored script kiddies, just lump it into "attacker".

(I've seen scenario modelling going recursive on threat actors; you can distinguish between external and internal attackers, but then you can also distinguish between self-motivated and coerced internal attackers, etc. ad infinitum. You'll likely never have the data to make anything resembling an informed estimate on probabilities here, and the deeper your taxonomy, the more the errors in guesstimates start to add up. Might as well just treat all of this as one aggregate "attacker".)