Insider Threat

People who intentionally misuse their access to harm the organisation:

• Data theft (e.g., stealing customer lists, trade secrets)

• Sabotage (e.g., deleting or altering critical systems)

• Espionage (e.g., selling data to competitors or nation-states)

Example: A disgruntled employee copies sensitive client data before resigning and joins a competitor.

Other examples are linked to organised crime, where employees are targeted due to the role in an organisation.  They could be threatened or offered significant amounts of money to cause a serious incident for their employer (e.g. ransomware).

Employees who accidentally cause harm by being careless:

Falling for phishing attacks.

Misconfiguring cloud storage (e.g., leaving data publicly exposed).

Sending emails or files to the wrong person.

Example: An employee clicks a malicious link in a phishing email, unknowingly launching ransomware on the company network.

Again, this risk is on the increase due to the adoption of AI by cyber criminals and also targeted attacks on specific individuals e.g. senior leaders in an organisation.

Insiders whose accounts or devices are hijacked by attackers:

Credential theft from phishing or brute force attacks

Malware infection that gives attackers remote access.

Example: A hacker gains control of an employee’s laptop and uses it to move laterally through the network unnoticed.

Note – this is often quite difficult to identify and manage as a compromised insider may not be aware of the situation for some considerable length of time.