What does APT stand for?
APT stands for Advanced Persistent Threat. A well-resourced, patient attacker, often state-sponsored, that gains access and stays hidden for a long time to steal data or prepare disruption.
An APT is an attacker with significant skill and resources, often backed by a state, that pursues a specific target over a long period. Advanced refers to the capability, persistent to the patience: the group gains a foothold, moves quietly, keeps several ways back in and stays for months. The goal is usually espionage or preparing disruption, not a quick payout.
APT in practice: an example
Investigators find that an engineering firm's design server has been sending small encrypted archives to an external host every night for seven months. The entry point was a phishing email to one engineer. The attackers used legitimate administration tools, which is why nothing was flagged.
What APT is confused with
APT vs ransomware gang: what is the difference?
Ransomware groups want money fast and announce themselves. An APT wants to stay unnoticed for as long as possible.
Which exams cover APT?
APT is on the official CompTIA acronym list for two of the four exams covered here.
- Security+ SY0-801: 2.3 (Threats, Vulnerabilities, and Attacks).
- CySA+ CS0-004: 1.4 (Security Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. Which characteristic best identifies an advanced persistent threat?
- A loud attack that ends within an hour
- Long-term, stealthy access to a chosen target
- Random scanning of the whole internet
- A prank by a bored employee
Show the answer
B. Long-term, stealthy access to a chosen target. Persistence and stealth against a selected target define an APT.
2. An intruder used only built-in administration tools and valid accounts for months. Why does this delay detection?
- Such activity blends in with normal administration
- Built-in tools cannot be logged
- Valid accounts bypass encryption
- Antivirus deletes the logs
Show the answer
A. Such activity blends in with normal administration. Using legitimate tools and credentials, often called living off the land, produces activity that looks ordinary. Behavioural detection is needed.
Sources: NIST glossary: advanced persistent threat. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.