An APT — advanced persistent threat — is a long-running, well-resourced intrusion in which skilled attackers get into a network, quietly stay for weeks or months, and work steadily toward a specific goal: stolen intellectual property, sustained espionage, or the groundwork for a major financial theft. The name describes the three things that make these attacks different from ordinary crime: the adversary is advanced (skilled, funded, often state-linked), the intrusion is persistent (they maintain access rather than hit-and-run), and the threat is targeted (your organisation specifically, not anyone who clicks the wrong link). For a small business, the practical relevance in 2026 is supply chain: state-linked groups increasingly reach SMBs through trusted vendors and software updates rather than attacking the SMB directly.
TL;DR
- An APT is a skilled, patient, targeted intrusion — usually state-linked — built to stay hidden, not smash and grab.
- The 2026 Verizon DBIR reports exploitation of vulnerabilities has overtaken stolen credentials as the top initial-access vector (about 31% vs 20%), which shows how APT-style tradecraft has entered ordinary crime.
- Small businesses mostly meet APTs indirectly: through a compromised supplier, MSP or software update.
- The tells are quiet ones — odd login hours, new devices, unfamiliar mail rules, unexpected MFA enrolments.
- The defence stack is the fundamentals, done thoroughly: patching, MFA, least privilege, logging, and staff who report.
The three words in advanced persistent threat
- Advanced — the adversary uses custom tools, zero-day exploits and careful planning. But do not overread this: the 2026 Verizon DBIR shows that ordinary criminals now routinely use APT-style techniques such as vulnerability exploitation, and state-linked groups happily reuse commodity malware.
- Persistent — the goal is long-term presence, not a quick payday. Attackers maintain footholds, create backup access, and move quietly toward the objective over months.
- Threat — the target is chosen deliberately, for what it holds or whom it connects to. Random opportunists are not APTs; a group working its way toward your client list or your government contract is.
The cybersecurity community catalogues this tradecraft in the MITRE ATT&CK framework — a public knowledge base of attacker tactics and techniques maintained by MITRE (attack.mitre.org) — which is why "APT-style" has become shorthand for technique-driven, patient intrusion rather than smash-and-grab crime.
How an APT attack unfolds
- Initial access. The way in is often boringly familiar: a spearphishing email, a purchased or stolen credential, an unpatched internet-facing system, or a trusted third party. The 2026 Verizon DBIR puts exploitation of vulnerabilities at roughly 31% of breaches as the top initial-access vector — ahead of credential abuse — with edge devices and VPNs as the common entry points (Verizon 2026 DBIR).
- Persistence. The attacker establishes durable footholds: new admin accounts, backdoors, scheduled tasks, and — critically — their own MFA devices enrolled on accounts they have touched, so losing one access route does not end the operation.
- Lateral movement and escalation. They move from the first compromised laptop toward the real prize: credential theft, network scanning, escalation to domain admin, and quiet mapping of where the valuable data and payment systems live.
- Collection or positioning. Depending on the goal: data exfiltration trickling out over weeks, long-term espionage, or positioning for ransomware — in modern double-extortion attacks, the quiet phase before the loud one.
- Covering tracks. Clearing logs, disabling security tools, and keeping at least one uncaught foothold for the next attempt.
Why small businesses meet APTs through the supply chain
State-linked groups generally do not bother hacking a 30-person firm directly — the return does not justify the effort. They reach small businesses the way water reaches a basement: through suppliers, managed service providers, and software the business trusts. A compromised MSP with 40 small-business clients is one intrusion with 40 payoffs; a poisoned software update reaches thousands of downstream businesses at once. This is why supply chain attack readiness — vendor verification, least-privilege MSP access, and knowing what software connects to your systems — is the APT-relevant part of a small business security plan.
The Australian Signals Directorate's Annual Cyber Threat Report documents state-sponsored activity targeting Australian networks as a standing feature of the 2026 threat landscape, alongside commodity crime (ASD Annual Cyber Threat Report). The practical takeaway for an owner is not panic — it is that the fundamentals matter more than ever, because APT tradecraft now flows downhill into ordinary crime.
The warning signs staff and owners can watch for
- Logins at unusual hours or from unfamiliar countries, especially on admin accounts.
- New MFA devices enrolled that nobody requested — the persistence step of a classic APT playbook.
- Mail rules that forward or hide messages, created without anyone asking for them.
- Admin tools appearing on machines that never needed them.
- Staff reporting pretexting or unusual IT requests that never turned into a ticket.
- Software or VPN appliances that never got patched — the unpatched edge device is the most common APT door in 2026.
None of these alone is proof of an APT. Together, and repeated over weeks, they are the pattern that deserves immediate escalation rather than a shrug.
What actually defends against an APT
- Patch the edge first. VPNs, firewalls and remote-access appliances are the entry points of choice. Patching them within days, not months, removes the most common door.
- Phishing-resistant MFA everywhere. Passkeys or security keys on admin and finance accounts starve both the credential-theft and the help-desk impersonation paths.
- Least privilege. Staff and vendors hold exactly the access their work needs — so one compromised laptop does not reach the domain admin.
- Logging and alerting. You cannot spot quiet persistence you are not logging; enable audit logging on email, identity and endpoints, and alert on new MFA enrolments and admin-account changes.
- Vendor and MSP hygiene. Know what connects to your systems, keep vendor access narrow and time-boxed, and include suppliers in your security gap assessment.
- A workforce that reports. The first sign of an APT is usually a human noticing something odd. Security awareness training that rehearses reporting — and human risk reporting that shows who actually reports — turns staff into the detection layer the logs cannot be.
FAQ
What is an APT in simple terms? A skilled, patient, targeted cyber attack — often state-linked — where the attacker gets in, stays hidden for weeks or months, and works toward a specific goal like espionage or theft, rather than a quick smash-and-grab.
Do APTs target small businesses? Rarely directly. But they reach small businesses through compromised suppliers, MSPs and software updates, and state-level tradecraft (especially vulnerability exploitation) has flowed into ordinary criminal attacks — the 2026 Verizon DBIR reports vulnerability exploitation as the top initial-access vector at about 31% of breaches.
What is the difference between an APT and normal malware? Ordinary malware is opportunistic: whoever clicks, wins. An APT is deliberate: a specific organisation is chosen, access is maintained over time, and the operation adapts to defences. The technique overlap has grown, but the targeting and patience are what define the APT.
What are the warning signs of an APT? Quiet ones: unfamiliar logins or hours on admin accounts, unrequested MFA enrolments, mail rules nobody created, admin tools on machines that do not need them, and unpatched VPN or firewall appliances that have quietly sat exposed for months.
How does an APT get into a network? The common doors are spearphishing, stolen credentials, unpatched internet-facing systems (VPNs and edge devices especially), and trusted third parties — vendors, MSPs or a compromised software update.
What should a small business do about APTs? Fundamentals, done thoroughly: patch edge devices fast, phishing-resistant MFA on admin and finance accounts, least privilege, logging and alerting, vendor access kept narrow, and a workforce trained to report oddities early.
One last thing
List every system that lets staff or vendors in from outside your network — VPNs, remote desktop gateways, any admin portal. Check the last patched date on each. That list, patched and locked down, is where 2026's APT-style intrusions start.