Within the FIVE-O framework, an individual is defined as which of the following?

Within the FIVE-O framework, an individual is defined as which of the following?

• A. A collection of programs that perform a function for the threat.
• B. A group or unit that provides a function that contributes to a threat capability.
• C. A person who provides one or more functions that contribute to a threat capability.
• D. An area that contains a threat.

Answer: (C)

In this framework, the focus is on who actually performs actions that enable a threat. An individual threat actor is a person who provides one or more functions that contribute to a threat capability. That means the person directly carries out, supports, or coordinates specific tasks—such as developing exploit code, conducting intrusions, or facilitating operations—that add to what the threat can do. Think of it as the human element behind the threat: someone who contributes the essential actions that make the threat possible. This distinguishes a person from other components like a collection of programs (which is a toolset or malware), a group or unit (which is an organization), or an area that contains a threat (which is a location).

In this framework, the focus is on who actually performs actions that enable a threat. An individual threat actor is a person who provides one or more functions that contribute to a threat capability. That means the person directly carries out, supports, or coordinates specific tasks—such as developing exploit code, conducting intrusions, or facilitating operations—that add to what the threat can do.

Think of it as the human element behind the threat: someone who contributes the essential actions that make the threat possible. This distinguishes a person from other components like a collection of programs (which is a toolset or malware), a group or unit (which is an organization), or an area that contains a threat (which is a location).