An entity that is partially or wholly responsible for an incident that impacts – or has the potential to impact - an organisation's security. Also referred to as a malicious actor.