Attacker sophistication is the level of skill, resources, and experience an adversary brings to an operation. It helps defenders estimate how hard an attack may be to detect, disrupt, or attribute. A highly sophisticated attacker may have custom tooling, operational discipline, infrastructure, and strong tradecraft. A less sophisticated one may rely on public tools, copied scripts, or simple social engineering.
This term matters because cyber defense has often assumed that dangerous operations require advanced operators. In practice, modern tooling can narrow that gap. Generative AI, automation, and packaged malware can let lower-skill actors draft phishing lures, adapt code, or iterate faster. That means defenders should not judge risk only by who is attacking. Instead, they should assess the techniques, automation, and resources in use, then build controls that block common paths such as phishing, credential abuse, and commodity malware.