Most organizations’ cyber defenses are built around an assumption that threats will be external.
They identify and implement controls and measures to detect and respond to unauthorized external actors trying to infiltrate their defenses and move towards their critical information assets.
But what if the threat is someone within the organization with all the permissions and access to sensitive information, systems, or facilities in an organization? It could be a recipe for a financial and reputational catastrophe.
What makes insider threats more dangerous is that they are not just overlooked but also unpredictable and harder to detect and prevent.
Let us take a closer look at what insider threats are and some of the risks and mitigations associated with insider threats.
What are insider threats?
Any person who has either authorized access to an organization’s resources, or has a thorough understanding of an organization, or both, and uses the understanding and access to pose a threat to the organization’s critical assets, data, progress, and reputation is an insider threat. It could be anyone, an employee, vendor, partner, or third-party contractor.
What are the main characteristics of insider threat?
The following are the characteristics of insider threats:
Must be:
- an employee/someone within the organization
- be someone who possesses authorized access and permissions
- be someone who is complacent/lazy
- be someone with malicious intent (like grudge, resentment, etc.)
What could be the motives of an insider threat?
The following could be the possible motives of an insider threat
- Financial motive
- Anger/Grudge/Resentment against the organization or a specific person or group of people within the organization
- Complacency/laziness
- Political/social/ideological/activism-related conflict
- Coercion/Blackmail from a third party
According to CISA, insider threats can manifest as damage to the department through behaviors like:
- Espionage,
- Terrorism,
- Unauthorized information leakage
- Sabotage
- Corruption and participation in transnational organized crime
- Intentional and unintentional loss/degradation of departmental resources
Some recent real-world examples of insider threats
The following are some real-world cases of insider attacks:
Case 1
In 2025, Opexsus, a US-based software company that offers software services and processes government records for federal agencies in the US, was compromised by two of its employees. The employees improperly accessed, leaked, and deleted sensitive documents, including sensitive data from federal agencies, such as the Internal Revenue Service and the General Services Administration. The total damage caused by them includes 30 databases and over 1800 files specific to a government project. The insider attack also caused the outage of two software record processing and management systems used by government agencies.
Source: https://www.insurancejournal.com/news/national/2025/05/21/824641.htm)
Case 2
In February 2025, a former employee of an Australian law firm, Slater & Gordon, orchestrated a massive email campaign (targeting 900 employees!) pretending to be the company’s people officer, targeting the firm’s current staff, in which the employee disclosed sensitive internal company information. The email exposed sensitive data, including salaries, strategic discussions, and private events. The employee’s motive was to defame the organization with allegations about the private equity owner, Allegro Funds.
Source: Slater + Gordon’s Internal Email Catastrophe Slater + Gordon’s Internal Email Catastrophe –
Case 3
Acts of complacency or negligence by individuals within the organization, especially those with highly privileged access, can also turn into severe insider threats. Madhu Gottumukkala, the acting director of Cybersecurity and Infrastructure Security Agency, uploaded materials classified “for office use only” to a public instance of ChatGPT. “For office use only” is a classification designated by the government for information that must never be disclosed in public/third party systems and platforms. It instantly raised Data Loss Prevention alerts. Madhu Gottumukkala acquired special permissions to use ChatGPT after joining in 2025. The incident raised serious security concerns since Chat GPT has 700 million active users globally, and OpenAI uses the user submitted content for enhancing responses for its users. The incident highlights the rise in insider threats due to the failure of governance of generative AI adoption. It shows how even an agency responsible for the protection of infrastructure and cybersecurity overall for the government can become a victim of an insider threat.
Source: CISA chief fed sensitive docs into ChatGPT | Cybernews
What are some of the risk and mitigations associated with insider threats?
Insider threats are more dangerous than other threats because they are unpredictable, since they are carried out by actors from inside who already possess authorization and permissions. This is why the damage caused by insider threats is costlier.
The following are some of the risks posed by insider threats:
- Data loss/exposure of sensitive information (for example, exposure of company secrets to third parties)
- Disruption of operations (for example, deletion of operational data)
- Financial loss (for example, the cost of damages due to operational disruption)
- Reputational damage (for example, loss of brand trust)
The following are some effective mitigation measures and best practices against insider threats:
- Take an inventory of all the critical assets, including information assets that can be exposed to insider threats like company secrets, prototypes, etc.
- Prepare a detailed insider threat mitigation program with the help of experts covering all the technological measures/controls, policies, and procedures to identify and prevent threats and ensure physical & digital security of critical assets.
- Perform background checks periodically– for employees, vendors, third-party providers, contractors, and partners.
- Enable continuous security monitoring – take assistance of security experts to enable round-the-clock monitoring of the network for any suspicious user activity (like transferring sensitive files or uploading company data online) while ensuring it doesn’t violate privacy regulations.
- Raise awareness – make employees aware of data security and cybersecurity best practices to reduce the risk of insider threats caused by human error/negligence.
- Establish a reporting mechanism – create a mechanism for employees to report any suspicious incidents/activities to make it easier to detect insider threats.
