Something I tell students learning about cybersecurity in 2021 is to always figure out how any crime or business conflict comes down to money. The vast majority of challenges we face in infosec come down to dollars and cents at the root, and it can help you understand motivation.

Even a lot of geopolitics, (another common motivator for both defenders and criminals in our field), often still comes down to cold hard cash in the end.

If you can consider questions like, “who’s getting paid”, “who’s not getting paid (enough)”, “who feels they desperately need more money” and “who stands to get paid if this breaks” it will tell you way more than just like, pointless tentative state attribution.