Also known as: malicious insider · insider risk
An insider threat is a security risk originating from someone with legitimate authorised access to an organisation's systems, whether acting maliciously, negligently, or through a compromised account.
The category spans three quite different problems: deliberate malicious insiders, well-meaning employees whose mistakes cause exposure, and external attackers operating through stolen insider credentials. The last is by far the most common and is functionally indistinguishable from the first without careful investigation.
Detection is hard precisely because the activity is authorised. Controls emphasise least privilege, separation of duties, access review, and behavioural analytics — with the persistent caution that heavy-handed monitoring damages trust and can create the resentment it aims to detect.
Principle of Least Privilege
The principle of least privilege holds that every user, process, and system should be granted only the minimum permissions necessary to perform its function, and no more.
Data Loss Prevention
Data loss prevention (DLP) refers to tools and policies that detect and block sensitive information from leaving an organisation through channels such as email, cloud uploads, or removable media.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Data Exfiltration
Data exfiltration is the unauthorised transfer of data out of an organisation's environment by an attacker, typically the final objective of an intrusion.