Security-related documentation (and casual conversation) often describes threats that require a lot of resources as "state sponsored"
Given that large mega-national corporations have more income than some countries' GDP, I want to include these corporations in threats that normally referred to as "state sponsored".
I can only assume that this isn't done because
- People aren't aware of this distinction
- Profit motivated corporations, and the means to those profits in relation to others is less understood
- Large corporations are paying for security reviews, and it's in the auditor's best interest to not not identify the client (or future clients) as a potential threat
- Large corporations are using public relations to highlight governmental distrust vs corporate distrust (Tin foil hat theory)
Regardless of possible reasons, what is the correct way to phrase this (in documentation) and what are some valid & rational reasons to group them together as a threat?