Australian organizations have a new threat to worry about, and it might be someone from their own organization.

What makes insider threats more damaging than any other threats is that they are often overlooked, unpredictable, and highly challenging to detect since the attacker already has permissions and access to systems and facilities within the organization.

A new study by Mimecast reveals that insider threats are rising in Australia at a faster rate than accidental/negligent security mistakes.

Let us look at some of the shocking findings of the study along with preventive best practices that Aussie organizations can use against them.

Business and cyber risks associated with insider threats

Insider threats can be more dangerous than external attacks, as an attacker already has a significant level of access to an organization’s resources and data. While not all insider threats are intentionally orchestrated, the following are all the possible motives behind insider threats:

Malicious insiders

Malicious insiders are people driven by motives like grudge, resentment, anger, financial gain, or social/political ideology/activism. They intentionally threaten or cause harm to an organization.

Negligent insiders

These are the people who create risks without knowing/unintentionally through negligence, mistakes, or complacency.

Compromised insiders

Organizational accounts that are hijacked/taken over by external attackers

Top risks associated with insider threats

The following are the top risks associated with insider threats:

• Data loss/destruction/alteration – primarily sensitive personal data and operational data.
• Financial loss – Australian organizations have reported a loss of $13.1 million per incident related to insider threat (Mimecast, State of Human Risk 2026).
• Operational disruption – Insider threats can cause disruption of operations due to the unavailability of systems and operational data.
• Reputational damage – it could have a lasting negative impact on the reputation of a brand due to loss of customer and investor trust

Source

The rising insider threats in Australia

A new study by Mimecast titled State of Human Risk 2026 brings shocking insights on the rising insider threats in Australia. It found that over 41% of Australian organizations have reported a rise in malicious and intentional insider attacks.

This is the first time that malicious insider threats have overtaken accidental employee errors (39%). It has become a cause of common worry for Australian organizations as 66% of them predict that insider-related risks will increase in the next 12 months.

Security experts have predicted that attackers could leverage malicious insiders with available authentication to bypass perimeter security entirely. The rise in the use of GenAI and collaboration tools has also expanded the attack surface as more people upload personal or company data on GenAI tools.

Australian organizations are subject to regulations like:

• Australian Privacy Act 1988 – adhering to Australian Privacy Principles for handling personal information.
• Notifiable Data Breaches (NDB) scheme – mandatory breach notification to OAIC) (part of APPs).
• Security of Critical Information Act 2018 (2021 reforms) – requirements for risk management, incident reporting, and other mandatory requirements for critical infrastructure organizations.
• ACSC’s Essential Eight – guidelines/alerts/best practices for building cyber resilience/hardening and mitigation strategies.
• Protective Security Policy Framework (PSPF) – security guidelines to be followed by government agencies and suppliers that handle government information.
• Criminal Code Act 1995 – reporting unauthorized access, modification or disruption/destruction of data/electronic communications.
• Telecommunications Act 1997 – cybersecurity obligations for the protection of telecom networks and infrastructure for carriers
• Contractual and procurement requirements – supply chain security controls that large organizations and government organizations are required to possesses.

Sector-specific regulations like:

• Banking and Finance – APRA (CPS234 – information security CPS230 -operational risk)
• Healthcare – cybersecurity, data security, privacy and reporting requirements in Privacy Act, APPs, Aged Care Act 1997, My Health Record Act 2012, and Quality of Care principles
• Telecom – Telecommunications Act 1997 and 1979
• Retail – Consumer Data Right (CDR), PCIDSS
• Energy & Utilities – cybersecurity obligations under Security of Critical Infrastructure Act 2018.

The rising insider threats have also increased worries for non-compliance, and with 91% of Australian organizations have reported having faced difficulties managing communication data for governance and compliance.

8 Preventive first steps against insider threats

Here are 8 preventive first steps that Australian organizations can use against insider threats:

1. Secure Email and collaboration channels

Over 96% of Australian organizations are expecting email-related cyber challenges like phishing and insider threats due to employee mistakes. But only a few are prepared for it. Organizations must proactively deploy unified security across email and other collaborative tools to prevent risks.

2. Strengthen data loss prevention and compliance

91% of Australian organizations have reported facing compliance challenges.

By creating policies for secure GenAI usage and deploying solutions for integrated Data Loss Prevention, automated compliance enforcement organizations can reduce the risk of data loss and non-compliance.

3. Integrate security tools into a unified platform

Lack of visibility due to tech sprawl or siloed solutions can prevent organizations from gaining early discovery of insider threats. Organizations must conduct a comprehensive audit of their current security stack for redundancies and consider platformization for centralized visibility and control.

4. Identify and manage human risk

Perform background checks for employees, vendors, third-party providers, contractors, and partners. Use behavioral analytics to create risk profiles (risky users, negligent users, compromised users, & targeted users), enable continuous monitoring across collaboration platforms focused on risky users.

5. Prepare an insider threat mitigation program

Take assistance of cybersecurity experts to create a detailed insider threat mitigation program that covers all the security/technological controls, policies, and procedures, to identify and prevent insider threats, and ensure the physical security of critical assets.

It must also include training and awareness programs that are adaptive to AI and deepfake threats, with best practices to reduce the risk of insider threats caused by negligence.

6. Establish a mechanism for reporting insider threats

Create a mechanism for safe and anonymous reporting of cybersecurity and insider threat incidents. It will help with early detection and mitigation of insider threats and overall improvement of the insider threat mitigation program.

7. Improve preparedness for AI threats

With a rise in AI-driven cyberthreats and increased usage of Gen AI tools for execution of tasks, Australian organizations must be prepared for the insider risks associated. Only 40% of Australian organizations reported being prepared against AI-driven cyber threats, with around 80% being concerned about AI vectors and social engineering. Organizations must create policies for the use of Gen AI tools to cut risks of shadow AI and associated insider threats due to negligence. They must deploy AI-powered detection tools and train employees on AI-driven social engineering and threats.

8. Implement technical controls

Gaining early visibility of signs of malicious insider risks within network can help mitigate damage and stop them before they turn into severe threats. Use DLP tools and UEBA to detect suspicious user activity, signs of data exfiltration/deletion/modification, and early detection of instances of negative communication to narrow down risks of insider threats.

20 insider threat prevention best practices aligned with Australian regulations

• Implement Role-Based Access Control and the Least Privilege Principle and periodically certify & review privileges (APPs & CPS 234).
• Use privileged access management (PAM) (APRA, CPS234, ASD guidelines).
• Enable Multi-Factor Authentication and secure session management (ACSC/E8).
• Separate duties for critical functions like finance, deployment, and access provisioning to reduce single-person risk (CPS 234/PSPF).
• Deploy SIEM with comprehensive logging (ACSC guidelines, IR guidelines under the Critical Infrastructure Act).
• Enable UEBA for early detection of suspicious activities and spot signs of data exfiltration (ASD/ACSC best practices).
• Implement data classification, and DLP controls that restrict the copy, transfer of sensitive information & personal information, and enable encryption for data in-transit and at rest (APPs).
• Deploy endpoint security and application control mechanisms to reduce the risk of malware deployment by malicious insiders (Essential Eight).
• Enable strict controls for removable media (disable USB and encrypt removable storage) and devices (NBD Obligations).
• Conduct background checks and exit interviews for employees and contractors, especially those in sensitive roles (Critical Infrastructure Act).
• Create security clauses (like right to audit and hygiene security controls) and supplier vetting for third-party employees, contractors (Critical Infrastructure Act).
• Identify systems that are sensitive and segment them to limit the lateral movement of compromised insiders (ASD/ACSC).
• Periodically validate whether managers need privileges through recertification and attestation. (APRA/PSPF).
• Implement controls for any changes in code and deployment, like audit trails, approvals, and code reviews (CPS 234/ ASD guidance).
• Create a comprehensive insider threat policy that is clearly communicated and acknowledged by employees with legal and disciplinary actions (OAIC/NDB cultural expectations).
• Establish a whistleblower program that offers protection and anonymity to whistleblowers for the early discovery of insider threats (Critical Infrastructure Act).
• Create incident response playbooks with insider scenarios, roles, forensic procedures, evidence preservation, and reporting channels. (Critical Infrastructure Act, NDB).
• Regular security audits, pentesting, and red teaming with insider threat scenarios and social engineering (PSPF/ACSC guidelines).
• Create policies for secure retention and disposal of data and credentials to limit insider access to any sensitive historical information (APPs/NDB).
• Create, maintain, and update cross-border data transfer and monitoring policies for early detection of unauthorized transfers (APPs).