1.3Threat Actors and Motivations

Understanding who attacks AI systems and why helps you prioritize your testing:

Threat Actor	Motivation	Typical Attacks	Sophistication
Curious users	Experimentation, fun	Simple jailbreaks, prompt extraction	Low
Competitors	Intellectual property theft	Model extraction, training data recovery	Medium
Fraud operators	Financial gain	Social engineering the AI, refund abuse	Medium
Data thieves	PII harvesting	Data leakage probing, cross-session attacks	Medium-High
Hacktivists	Embarrassment, ideology	Making the AI say offensive things	Medium
Nation-state actors	Espionage, disruption	Supply chain poisoning, advanced injection	High
Automated bots	Scale attacks	Mass prompt injection, credential stuffing	Varies

Your security testing program should cover the threat actors most relevant to your application. A customer-facing chatbot faces different threats than an internal code review tool.