Least-skilled threat actors used about 16 distinct techniques on average, while the most skilled used about 20.

In November 2025, a disrupted state-sponsored cyber espionage operation used 30 techniques across 13 tactics.