Hackers come in different capabilities. There are many so called "script kiddies" that use exploits of well-known vulnerabilities that are available on the Internet. Often they have no knowledge of how these exploits work but they are able to use them and break into a system.
The cyber terrorist is an intelligent, well trained and determined hacker. Idealism, financial gain or threats can cause this determination.
Between these two limits there is the unhappy employee or the industrial spy. Of course, simulating a skilled cyber terrorist is much more laborious than running a vulnerability scanner to simulate the "script kiddie". It depends on the type of organization (small business, critical infrastructure provider) what type of threat is most applicable.