Home / Knowledge hub / Insider threat
Knowledge hub
Insider threat
Harm from someone with legitimate access, through malice or by mistake.
What it means
An insider threat is harm to your organisation by someone who already has legitimate access: an employee, contractor, partner or former staff member whose access was never removed. The harm can be deliberate, such as stealing customer data, or accidental, such as sending a spreadsheet to the wrong person.
The idea that makes it click: the attacker does not need to break in, because the door was opened for them. Most defences are built to keep outsiders out, so a person with a valid account can often do a great deal before anything looks unusual.
Why it matters
Insiders know where the valuable data is and how your checks work. A departing salesperson takes the customer list, an administrator reads records they were curious about, a developer pastes a key into a public repository. Any of these can become a data breach you must disclose.
Accidents are far more common than malice, and the cost to trust is the same. Customers and auditors will ask what limits you had on who could see what, and whether you would have noticed. That is why access rules and audit logs matter before an incident.
How it shows up
It shows up as access that outlasts the role: accounts left active after someone leaves, admin rights that accumulated over years, shared logins, and a support tool that shows every customer record to anyone with a login. See privilege creep.
Useful controls are least privilege, prompt offboarding, separation of duties for sensitive actions, regular access reviews and logs of bulk exports that someone actually reads. Check the internal admin tools too, because they are often the least protected part of an application.
Questions people ask
Insider threat, answered
Is an insider threat always malicious?
No. Most incidents involving insiders come from mistakes, such as misdirected email, misconfigured storage or clicking a phishing link. Others come from people who bend rules to get work done.
Controls should assume honest error as well as bad intent.
How do you detect an insider threat?
Look for behaviour that does not fit the role: large exports, access to records unrelated to the person's work, sign-ins at odd hours, use of accounts that should be dormant.
That needs logs retained and reviewed. Detection is much easier when access is already narrow.
Does least privilege stop insider threats?
It limits the damage, but does not remove the risk. Someone must still have access to do their job.
Combine it with logging, separation of duties for risky actions, and quick removal of access when roles change.
Are contractors and former staff insiders too?
Yes. Anyone with credentials or system access counts, including vendors and partners. Former staff matter when their accounts or keys remain active.
Offboarding should cover accounts, shared secrets and API keys.
Can application testing find insider risk?
Partly. A test can show whether a low-privilege account can reach admin functions or other accounts' data, which is the same path a curious insider would take.
It does not replace people processes such as access reviews.
Sources
Where this comes from
Related
Terms that sit next to this one
Least privilege
Giving every person and service the minimum access the job requires.
Privilege creep
People collecting more access over time than their current job needs.
Separation of duties
Splitting a sensitive task so no single person can complete it alone.
Access review
A regular check that each person still needs the access they hold.
Audit log
A record of who did what and when, kept so you can answer later.
What can a normal account reach?
We check what each signed-in account can reach that it should not, including admin functions, and every finding carries the request and response that proved it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.