A threat actor is a person or group that carries out an attack. Actors differ in motive, resources and patience, from an opportunist using a default password to an organized group targeting a specific organization, and the defenses that matter depend on which one is realistic for the site.
Threat modeling starts with who might attack and why. A bored intruder, a departing employee and a funded criminal group need very different controls, and a site can rarely afford all of them equally.
The categories that matter
Insiders have legitimate access, criminals seek property or data, hacktivists pursue publicity and nation-state groups pursue intelligence. Capability and willingness to persist vary enormously between them.
Turning it into priorities
Match controls to the plausible actors: credentials and logging against insiders, segmentation and patching against remote attackers, physical delay and detection against intruders. Whatever the actor, the aim is to make the attempt slow, visible and expensive.