What can we learn from threat actors?