What does actor class predict when one crew defaces the web server it took and another quietly sells the same access?

## The setup, and why it is the right test Two crews obtain the same thing: code execution on a web server in your public-facing estate. One replaces the home page with a manifesto and announces it. The other changes nothing visible, keeps a quiet path back in, and sells or reuses the access. The technical position is the same. Everything that differs is *what the access is for*, and that is precisely the thing actor class predicts. This is the whole argument for keeping actor classes in your vocabulary at all. They are not descriptions of skill. They are predictions of three things you cannot read off the technical facts: what the access will be spent on, what tempo to expect, and what happens after you put them out. ## The four readings | Class | What the access is for | Tempo | After eviction | What it has to lose | |---|---|---|---|---| | Hacktivist | An audience; the message is the objective | Bursty, often timed to an external event | Usually finished once published | Little - attribution is often wanted | | Criminal | Conversion to money, directly or by resale | Fast; time-to-money matters | Rarely returns to an estate that got expensive | Money, and cost-sensitivity all the way down | | State-sponsored | A requirement that outlives the campaign | Patient; measured in months | Attempts re-entry, often by a different route | Exposure of access and tooling; may go quiet instead | | Lone operator on a public exploit | Whatever the exploit happens to give | Immediate, then nothing | Does not adapt; the episode ends | Nothing | Read the defacement against that table and it settles quickly: publicity is not a side effect, it is the product. Which also means the access had no preservation value - burning it publicly *is* using it. Read the quiet crew the same way and the inverse holds: any noise reduces the worth of what they hold, so silence is not sophistication, it is accounting. ## Why the capability ladder is wrong The reflex answer ranks the classes by skill with nation-states at the top, criminals next, hacktivists below them and script kiddies at the bottom. It fails twice. First, it is wrong on the facts at the top. Large financially motivated crews have money, staff, deadlines and a market that rewards speed; several have turned around exploitation of a newly disclosed appliance vulnerability across hundreds of estates faster than any government process could. Meanwhile state-sponsored operations, the ones you actually meet, run overwhelmingly on stolen credentials and tooling that already exists on the host, because that is cheap and quiet and does not burn anything expensive. Second, and more damaging, a ranking answers a question nobody asked. Suppose the ladder were true - what would you do with it? "They are more capable" produces no decision. "They will come back after we evict them" produces several. Class earns its place in the conversation by predicting behaviour, and a ranking predicts nothing. ## What each reading changes about the response The two crews in the scenario point at different control classes, which is the practical payoff. For the publicity-driven crew, the asset is the content path: who can write to what is served, how that write is authorised, and whether a change to the served content requires something more than a single credential. The damage is done at publication, so the value is entirely in prevention of the write. For the crew treating access as inventory, the asset is the *durability* of what they took. If they hold a credential, its worth is proportional to how long it keeps working: short credential lifetimes and authentication a stolen secret cannot satisfy - a hardware-backed FIDO2/WebAuthn factor, for instance - remove the resale value directly. Hardening the defaced page against them is aiming at the wrong thing entirely, because they were never going to touch it. And the class also tells you when to stop. A crew whose economics are return-on-effort walks away when your estate becomes more expensive than the next one; a crew whose objective is a standing requirement does not, and eviction should be planned as an interruption. ## Talking about it without over-claiming Two disciplines keep this honest. The behaviour is evidence *for* a class, not proof of one; a defacement can be run by a contractor, and a quiet crew can be either of the other two. And the class is a prediction about motive and tempo, which means it should be stated as a prediction - "if this is a resale-driven crew, we should expect the credential to be used again from elsewhere" - so that it can be wrong out loud rather than quietly steering the plan. ## What good sounds like Name that the position is identical and therefore uninformative; read the *spend* of the access as the signal; give the tempo and the post-eviction prediction for each class; and reject the ladder explicitly, with the observation that criminal crews often out-execute state units and state units mostly use commodity technique.