What is a threat actor?

This definition is too narrow, specifically limiting to external business partners and not covering the full scope of threat actors.

This definition is also too narrow, focusing only on internal individuals (insiders) and excluding external threat actors.

A threat actor is a broad term encompassing any individual or group, whether internal or external to an organization, who has the intent and capability to cause harm to an information system or organization. This includes state-sponsored groups, organized crime, hacktivists, insider threats, and even script kiddies, covering a full spectrum of adversaries.

This definition is too restrictive by only including 'unauthorized persons' like script kiddies or hackers, omitting authorized insiders who become threats, and also nation-states or organized crime.