Advanced persistent threat (APT)

The expression advanced persistent threat designates both a type of attack and the actor that conducts it, generally a group with substantial resources, often linked to a state or acting on its behalf. Three traits characterize it. It is advanced, because it mobilizes high technical skills and sometimes novel vulnerabilities. It is persistent, because the attacker seeks to settle durably in the targeted system, sometimes for months or years, remaining as discreet as possible. Finally, it is an organized and determined threat, pursuing precise objectives, economic or political espionage, theft of intellectual property, preparation for sabotage. Unlike opportunistic crime that strikes at random, the APT chooses its target and patiently adapts its methods. For insurance, these attacks pose singular difficulties, because their sophistication defeats standard defenses, their duration lengthens dwell time and thus the scale of damage, and their frequent state origin raises the question of attribution and of the possible application of war or sovereign-act exclusions, making the APT a recurrent point of friction between insureds and insurers.

An APT group discreetly infiltrates the network of a strategic manufacturer and remains there for eighteen months, slowly exfiltrating manufacturing secrets. The belated discovery reveals the scale of the theft and opens a debate on the state origin of the attack.

APT, advanced persistent threat, menace persistante avancée