Threat actor psychology: What investigations reveal about how attackers think

Behind every cyber attack is a human being making decisions — some strategic, some emotional, but all deliberate. Whether it’s a well-organised criminal syndicate, a rogue insider, or a state-backed threat actor, each attack reflects a set of priorities, behaviours, and patterns. The more we understand those patterns, the better positioned we are to defend against them.

In this session, Jesse Pearce and Darren Hopkins from McGrathNicol will explore what real-world investigations reveal about how attackers think. Drawing on their experience across hundreds of cyber incidents — including ransomware events, insider threats, and targeted intrusions — they will unpack the behaviours, tactics and decision-making processes of threat actors in live environments.

This session will go beyond technical analysis to look at the psychology and strategy behind the attack. Jesse and Darren will examine actual threat actor playbooks observed during incident response — how and when attackers escalate, when they pivot or pause, and how they exploit gaps in organisational visibility or hesitation in decision-making.

A unique element of this session is the inclusion of insights drawn from direct interactions with attackers during ransomware negotiations. McGrathNicol has supported numerous clients through the high-stakes process of negotiating with threat actors, and these conversations provide a rare window into attacker motivations, negotiation tactics, and behavioural cues. These real-time exchanges often reveal as much about an adversary’s intent and confidence as their malware does, and can influence how defenders choose to respond.

The presentation will also cover how threat actors adapt once defenders begin to act. In several cases, McGrathNicol teams observed threat actors re-entering compromised environments, using deception techniques to buy time, or responding aggressively to remediation efforts. Understanding these shifts in behaviour is critical for containing threats and avoiding escalation.

This session is not about threat intel feeds or kill chain diagrams. It’s about learning how to interpret and anticipate the human element of an attack. Attendees will leave with a better understanding of what drives different types of threat actors, how they behave under pressure, and how that knowledge can help security teams stay one step ahead.

Whether you’re leading response efforts, supporting strategy, or advising the board, this session will give you the tools to think like the adversary — and turn that insight into stronger, faster, and more informed defence.