Insider Threats and Behavioural Vulnerabilities

Insider threats represent one of the most challenging dimensions of cyber security management precisely because they involve individuals who already have legitimate access to the systems and data they exploit. Unlike external attackers who must find a way in, insiders are already inside. Managing insider risk requires a fundamentally different approach from managing external threats: one that balances security with trust, monitoring with privacy, and protection of the organisation with respect for the dignity and rights of employees.

The scale of the challenge is significant and growing. According to the Ponemon Institute’s 2025 Global Cost of Insider Threats Report, the global average total annual cost to resolve insider incidents reached $17.4 million per organisation. Between 2020 and 2024, insider-driven data exposure incidents increased by 28% year on year. The 2024 Cybersecurity Insiders report found that 83% of organisations reported at least one insider attack in the previous year, and that 76% of organisations reported increased insider threat activity over the preceding five years while fewer than 30% believed they had the right tools and processes to address it.

The Insider Threat Spectrum

It is a common mistake to frame insider threats exclusively in terms of malicious actors: the disgruntled employee deliberately stealing data or the corporate spy working for a competitor. In reality, the Ponemon 2025 data shows that non-malicious insiders account for 75% of insider incidents, with negligent employees causing 55% of events and compromised users (those whose credentials have been stolen by external attackers) accounting for a further 20%. Malicious insiders, while they attract the most attention and tend to cause the most severe individual incidents, represent only 25% of the total.

This distribution has important implications for management. A risk management strategy focused primarily on detecting and deterring malicious actors will miss the majority of insider incidents, which are caused by well-intentioned people making mistakes, following unsafe practices or falling victim to social engineering. Both categories require attention, but they require very different responses.

Malicious Insider Threats

Malicious insider incidents involve individuals who deliberately exploit their access to cause harm to their organisation. The motivations vary considerably:

• Financial gain: the most common motivation for malicious insider incidents, with 89% of malicious insider breaches motivated by personal financial gain according to the Verizon DBIR. This includes theft of intellectual property for sale to competitors, financial fraud, and the sale of access credentials or sensitive data to external criminal groups.
• Retaliation: employees who feel wronged by their organisation, whether through a disciplinary action, a redundancy decision, a missed promotion or a perceived injustice, may seek to cause harm as a form of retaliation. The risk of retaliation-motivated insider attacks is highest in the period following significant negative employment events.
• Ideological motivation: a small but significant category of insider threats are motivated by political, ideological or activist convictions. This includes employees who leak sensitive information to journalists or activist groups, as well as nation-state-sponsored actors who obtain employment at target organisations specifically to conduct espionage.
• Coercion: employees may be coerced into providing access or information by external criminal groups, typically through threats to themselves or their families or through the exploitation of personal vulnerabilities such as financial difficulties or compromising personal information.

Non-Malicious Insider Threats

The majority of insider incidents are caused not by bad intent but by human error, poor judgement under pressure or inadequate knowledge of security requirements. Common categories include:

• Negligent data handling: sending sensitive information to the wrong recipient, storing data in unapproved locations, disposing of confidential documents insecurely, or using personal devices and applications to handle work data without authorisation. These errors are frequently the result of convenience-seeking behaviour in the face of security processes perceived as cumbersome.
• Credential compromise: employees whose login credentials are stolen through phishing or data breaches at third-party services effectively become compromised insiders: their legitimate access is used by an external attacker, creating an incident that looks superficially like internal access. Credential theft accounted for 20% of insider incidents in the Ponemon 2025 study.
• Privilege misuse: accessing data or systems beyond what is necessary for one’s current role, whether out of curiosity, for personal convenience or through misunderstanding of access policies. This is particularly common in environments where access rights are not regularly reviewed and excess permissions accumulate over time.
• Shadow IT: the use of unapproved tools, applications and cloud services that are not governed by organisational security controls. Employees who adopt new tools to solve a genuine operational problem without understanding the security implications are not acting maliciously, but the risks they create are real.

Managing Insider Risk: A Manager’s Framework

Effective insider risk management requires a layered approach that addresses both the technical and human dimensions of the problem. For managers, the most directly relevant elements are:

• Access management and least privilege: ensuring that team members have access only to the data and systems they genuinely need for their current role, and that access is promptly reviewed when roles change or when someone leaves the organisation. Regular access reviews are one of the most effective and most neglected insider risk controls.
• Behavioural awareness: understanding the factors that tend to precede insider incidents, including significant personal stressors, negative employment events, unusual access patterns, and departures from normal behaviour. This does not mean treating employees as suspects; it means maintaining the kind of attentive, engaged management relationship that allows unusual situations to be noticed and addressed early.
• A non-punitive reporting culture: creating an environment in which employees feel safe reporting their own mistakes, raising concerns about colleagues’ behaviour and flagging security incidents without fear of disproportionate consequences. A reporting culture is the single most effective early-warning system for insider incidents of all types.
• Offboarding procedures: ensuring that when a team member leaves the organisation, whether voluntarily or otherwise, all access to systems, data, email accounts, collaboration tools, cloud services and physical premises is revoked promptly and completely. The Optus breach examined in Week 4 illustrates the consequences of failing to do this.
• Proportionate monitoring: understanding what monitoring your organisation has in place for insider risk, and ensuring it is implemented and governed in a way that is proportionate, transparent and legally compliant. The ethical dimensions of monitoring are examined in depth in Step 4 of this week’s learning.

Insight: The Cost of Containment Time

The Ponemon 2025 data reveals a striking relationship between the time taken to contain an insider incident and its cost. Incidents contained within 31 days cost an average of $10.6 million to resolve. Incidents that took more than 91 days to contain cost an average of $18.7 million. This disparity underscores the importance of early detection and rapid response: every day that an insider incident goes undetected or uncontained adds significantly to its eventual cost. The investment required to build the management practices, access controls and reporting culture that enable earlier detection and faster containment is almost always considerably less than the cost of the incidents they prevent.