An operative is a person assigned to carry out specific tasks inside a campaign. In cyber security, that can mean contacting victims, moving money, delivering malware, collecting intelligence, or applying pressure while others handle planning and infrastructure. The term is useful because it separates the human role from the technical tools used in an operation.
Operatives matter because many attacks are not fully automated. Extortion crews, fraud rings, and intrusion teams often use people to negotiate, impersonate support staff, verify targets, or push a victim toward payment. Defenders can spot operative activity through unusual phone calls, email follow-ups, payment demands, or coordinated contact from multiple identities. Treating these interactions as part of the attack helps security teams document evidence, escalate quickly, and disrupt the campaign before it succeeds.