Security-related documentation (and casual conversation) often describes threats that require a lot of resources as "state sponsored"

Given that large mega-national corporations have more income than some countries' GDP, I want to include these corporations in threats that normally referred to as "state sponsored".

I can only assume that this isn't done because

  1. People aren't aware of this distinction
  2. Profit motivated corporations, and the means to those profits in relation to others is less understood
  3. Large corporations are paying for security reviews, and it's in the auditor's best interest to not not identify the client (or future clients) as a potential threat
  4. Large corporations are using public relations to highlight governmental distrust vs corporate distrust (Tin foil hat theory)

Regardless of possible reasons, what is the correct way to phrase this (in documentation) and what are some valid & rational reasons to group them together as a threat?

  • Tin foil hattery aside (which is the reason I downvoted), states have 'legal' ways to use rubber hose. Corporations don't. Commented May 20, 2015 at 15:00
  • I wouldn't doubt that in some countries, a corporation can influence a state to act as a proxy. They already place the individuals they want in power by funding their campaigns Commented May 20, 2015 at 15:08
  • 1
    not a security question. There's Politics SE out there. Commented May 20, 2015 at 15:09
  • True, but this is security related documentation... Commented May 20, 2015 at 15:10
  • 2
    "State-sponsored" is a straw man, so it doesn't really matter in any case. If you want to be technical, you could simply use "organized crime", which includes a wider set of possibilities.
    – schroeder
    Commented May 20, 2015 at 18:18

1 Answer 1



When people talk about "nation state threats" what they really mean is "well funded nation state threats". They're not talking about a poor African state developing advanced cyber warfare. And even though companies like Apple make as much (or maybe more) than the NSA's budget, no-one expects that they would dedicate a large proportion of their budget to cyber espionage. Among other things, they'd have to be careful not to get caught, while the NSA operate with legal impunity.

You've not mentioned exactly what documents you're referring to. If you mean corporate security policies, then it's only relevant to them to have a very rough concept of attacker capabilities. It's worth distinguishing between script kiddies, organised crime and state espionage. But going down to the detail of "a major corporation who has influence over a minor state government" just isn't helpful. That doesn't help you decide whether Joe is allowed to use a USB stick, or Fred can keep using Internet Explorer 6.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .