Cyber Espionage: What It Is, How It Works and How Organizations Defend Against It

What cyber espionage is

Cyber espionage is the use of computers and networks to gain unauthorized access to secret or sensitive information, for the advantage of whoever receives it. The goal is to collect, not to disrupt, so success means going unnoticed.

NIST’s glossary describes the closely related advanced persistent threat as an adversary with sophisticated expertise and significant resources, which uses multiple attack vectors to establish and extend footholds in an organization’s IT infrastructure for purposes such as continually exfiltrating information. It adds that such an adversary pursues its objectives repeatedly over an extended period, adapting to the defender’s efforts to resist it. Not every cyber espionage actor fits this description, but it captures the typical pattern: patient, persistent and adaptive.

How it differs from related terms

The FBI draws a legal line. In its guidance on economic espionage, theft of trade secrets happens when someone knowingly steals or misappropriates a trade secret for the benefit of anyone other than the owner. Economic espionage is the same act done for the benefit of a foreign government. The FBI notes that proving the foreign link in court is difficult, so cases are often charged as trade secret theft.

The categories overlap in practice. An intruder who starts as a criminal may sell what they find, and a state-linked group may use criminal tools. Defenders usually do not need to settle who is behind an attack before they respond to it.

Who is targeted and what is taken

The FBI says economic espionage has historically focused on defense and high-tech industries, but that no industry, large or small, is immune. Any organization with a valuable product, process or idea can be a target. Typical prizes include:

• Designs, source code, formulas and manufacturing methods.
• Research data and unpublished results.
• Merger, pricing and strategy documents.
• Government and policy communications.
• Email and credentials, which open the door to everything else.

Smaller firms are also targeted, often as the weaker link into a larger partner.

How an intrusion typically unfolds

The stages below are a general, defensive view that matches how NIST and CISA describe persistent intrusions. They are not instructions.

A documented case: SolarWinds

One of the best-documented cases is the compromise of SolarWinds Orion network management software. The details below come from the US Cybersecurity and Infrastructure Security Agency (CISA) alert AA20-352A, first issued in December 2020 and last updated April 15, 2021. CISA may have issued newer guidance since, so check its site.

• The method. The attacker added a malicious version of an Orion software library to the vendor’s software lifecycle. It was signed with the legitimate SolarWinds code-signing certificate, so customers who installed the update received a backdoor from a trusted source.
• The timeline. CISA says compromises began at least as early as March 2020.
• The victims. The alert describes compromises of US government agencies, critical infrastructure entities and private sector organizations. It also says not every organization that received the backdoor was targeted for follow-on activity.
• The follow-up. Besides the backdoor, CISA reports initial access through password guessing and spraying and poorly secured administrative credentials. It also describes the theft of a signing certificate to forge valid tokens for hosted services such as email.
• The behaviour. CISA described the actor’s patience, operational security and complex tradecraft. It said the activity may not be visible to the legitimate owners of systems.
• Attribution. On April 15, 2021, the US government attributed the activity to the Russian Foreign Intelligence Service (SVR), per the alert’s update.

Lessons. Trusted software can carry an attack. Administrative credentials and identity systems are prime targets. And detection depends on logging, as CISA’s advice shows: keep logs for at least 180 days in a centralized system, enable multi-factor authentication, reset exposed credentials, and prepare out-of-band communications in case the usual channels are compromised.

The human side: insiders and social engineering

Technology is only half of it. The FBI’s guidance describes how companies were approached through social media to identify and assess employees, through a recruiter acting as a proxy to find people open to leaving, through a proposed joint venture, and through attempted cyber intrusion and bribery. It lists insider warning signs such as excessive printing, use of encryption software, spikes in data transfers and unusual access times, and recommends that companies develop an insider threat program.

Warning signs are only signals. Treat them as reasons to look, not proof of wrongdoing, and handle them through HR and legal processes with care for employees’ rights.

How to defend: the NIST framework

NIST released version 2.0 of its Cybersecurity Framework on February 26, 2024. It has six functions and applies to organizations of any size. The table gives example actions for each function against an espionage threat. It is our summary, not NIST’s wording.

For detection in more depth, see breach detection.

A checklist for smaller organizations

You do not need a large security team to cut your risk. Start here.

If you suspect espionage or trade secret theft in the United States, the FBI advises reporting early, before proprietary information is irreversibly compromised, through your local field office. Outside the US, contact your national cyber authority.

Careers and pay

Defending against espionage is the work of security analysts, incident responders, threat hunters and security managers. The U.S. Bureau of Labor Statistics (BLS) reports for information security analysts a median pay of $129,180 (May 2025), 192,900 jobs in 2025, and projected growth of 21% from 2025 to 2035, which it calls much faster than average. It lists a bachelor’s degree in a computer field as typical entry education and notes employers may prefer analysts with professional certification. These are figures for the occupation, not for any course, and they do not guarantee a job.

Read more in the growing need for cybersecurity professionals and our guide to information security certificates. Online providers such as Coursera and Udemy list security courses. We may earn a commission if you sign up, at no cost to you. We are not affiliated with any university. Check each syllabus and update date.

Frequently asked questions

What is cyber espionage?

Using computers and networks to gain unauthorized access to secret or sensitive information, usually while staying hidden for as long as possible.

What is the difference between cyber espionage and cybercrime?

Espionage aims to collect information for advantage. Cybercrime usually aims for money. The methods can overlap.

What is an advanced persistent threat?

NIST describes it as a sophisticated, well-resourced adversary that pursues its objectives repeatedly over a long period, adapting to defenders’ efforts.

What was the SolarWinds attack?

A supply chain compromise in which a malicious update to Orion software, signed with a legitimate certificate, delivered a backdoor to customers. CISA says compromises began at least as early as March 2020.

How can small businesses protect themselves?

Turn on multi-factor authentication, patch promptly, limit access, keep centralized logs, train staff, know your suppliers’ access, and write an incident plan.

Who should I report suspected espionage to?

In the United States, the FBI recommends contacting your local field office early. Elsewhere, contact the national cyber security authority and get legal advice.