Maybe I am misunderstanding your post, but I get the impression you consider APT == script kiddie. I was of the opposite understanding, that Advanced Persistent

Maybe I am misunderstanding your post, but I get the impression you consider APT == script kiddie. I was of the opposite understanding, that Advanced Persistent Threat != script kiddie. It seems right there in the name, an entity that's been and continues to be around, and has shown from TTP analysis that they have the resources to have nice tools, and the competence to use them well. I suppose you could maybe consider the constant presence of skiddies over time to be a Persistent Threat, but probably not an Advanced one. I have also heard of companies claiming to have been breached by an APT to try to excuse their poor or lack of security process. But my understanding of script kiddies vs APT was that the former does things like buying lists of systems accepting RDP connections from the public internet, and then proceeding to light up the SOC like a Christmas tree when they start deploying crypto miner bots. And that the latter comes in over a supply chain compromise, uses heretofore-not-analyzed malware to compromise monitoring so their traffic data is "accidentally" discarded by the netflow collectors, and then patiently spreads across the enterprise through lateral movement until they find the credit card numbers or diplomatic documents, depending on whether they are a criminal fraud group or state espionage group.