Threat actors

Attackers differ in what they want, what they can spend and what they are willing to risk, and those three things predict almost everything else.

A criminal group optimising profit behaves completely differently from a state operation with time and no commercial pressure, and differently again from someone ideologically motivated who wants attention. Defending against "hackers" as one category produces generic controls. Knowing which kind would plausibly come for you tells you what to prioritise.