This is the closest to correct. There are some other valuable things state level threat actors have at their disposal.