Technology

Well, I'm not a cybersec specialist, but my job requires us to comply with NIST cyber security frameworks, including going through external audits every year. In my opinion, your basic generalities are fine for those not working in that field specifically.

However, for cyber security analysts and other specialists, I think specific subcategories are necessary. The reason being, IT is an absolutely massive field that contains a ton of specialties. As such, that means there are roughly an equal variety of malicious actors in the same field.

There's no such thing really as a general "hacker" anymore. Especially when you take into consideration the rapid expansion of state sponsored cyber attacks/warfare. You'll have specialists for various types of:

• phishing (e.g. targeting general pop/employees, or those going for specific people)
• cryptography (e.g. those who try to compromise an org's PKI, or people finding vulns to exploit expired certs like what happened with Azure last year)
• vuln hunters/exploiters (e.g. people that monitor known vulnerabilities and probe orgs' defenses to see if those vulns are present/unpatched/unmitigated, or even people who try to discover new ones)
• malware engineers (e.g. fairly self explanatory, but malware is a very broad term and can come in numerous shapes and sizes, like even using infected images on a website to conduct RCE on mobile devices like what happened a year or two ago)

Sorry, tangent is getting a bit long-winded now. Anyway, tldr; general terms are fine for laymen or non-specialists, but more precise terms are beneficial for experts in that field.