Usually true, but not consistently. There are applications which by design have accounted for internal threats but not state actors strictly because of the moti

Usually true, but not consistently. There are applications which by design have accounted for internal threats but not state actors strictly because of the motivations of the threat actors themselves. To drastically simplify it: - Internal threats are usually motivated by finance/challenge/spite. - State actors are usually motivated to counter perceived national security threats regardless of whether they're short-term or long-term. The result is a preparedness to spend resources orthogonally as compared to the potential impact of the threat to anyone other than the state but which may be directly correlated to the perceived risk to the state itself. In simpler terms: risks exploitable by internal threats versus state actors do not assuredly overlap, and a lot of it is because risks exploitable by possessing knowledge might not be the same as risks exploitable with gobs of money.