Insider Threats: Malicious, Negligent & Compromised

Every security control you buy is designed to keep the wrong people out. Insider threats are the case where the wrong person is already in, holding a badge, a laptop, and a valid login. That is what makes them the hardest category to defend against. There is no perimeter to breach and no exploit to detect. There is only legitimate access being used in an illegitimate way, and the challenge is telling the difference.

An insider threat is the risk of harm from someone with authorised access to an organisation's systems, data, or facilities. That definition, close to the one CISA uses, deliberately covers more than the disgruntled employee of popular imagination. It includes the careless, the tricked, and the compromised. This guide breaks the problem into its real components and lays out how a working program addresses each.

The three kinds of insider

Lumping all insiders together leads to bad controls, because the three types have different causes and different fixes.

Malicious insiders intend harm. The motive is usually money, grievance, or ideology: stealing data to sell, sabotaging systems on the way out, or leaking information to make a point. They are the smallest group by number, but individual incidents can be severe because the person knows exactly where the valuable data is and how to reach it.

Negligent insiders cause harm without intending it. They email a spreadsheet to the wrong address, misconfigure a storage bucket, reuse a password, or click a phishing link. There is no malice, only mistake, but the outcome can be identical to an attack. This group is large, and it is where a great deal of real-world data loss originates.

Compromised insiders are people whose legitimate access has been hijacked by an outsider. The employee did nothing wrong on purpose, but their credentials, session, or device are now under external control. From the system's point of view, the attacker is the insider. This is the bridge between insider and external threats, and it is why credential theft matters so much.

Insider type	Intent	Primary driver	Strongest control
Malicious	Deliberate harm	Money, grievance, ideology	Least privilege, monitoring, offboarding
Negligent	Accidental harm	Human error, poor process	Training, guardrails, data-loss prevention
Compromised	None (access hijacked)	External attacker	Strong authentication, session controls

The three types in practice

The categories are easier to hold onto with concrete shapes, described in the general and without any named person or event.

The malicious insider is a developer who has accepted a job at a competitor and, in the final weeks, copies source code and customer lists to a personal drive. Nothing they touch is outside their normal access. The only anomaly is the volume and the timing, and the intent behind it.

The negligent insider is an operations engineer who, under time pressure, makes a storage bucket public to unblock a deploy and forgets to close it. There is no motive and no attacker, yet sensitive data is now exposed to anyone who finds the address. The same careless step could have been a mistyped email recipient or a reused password later found in a breach dump.

The compromised insider is a finance clerk whose password was captured by an infostealer and whose multi-factor prompt was relayed by a phishing kit in real time. The attacker now logs in as the clerk, from the clerk's own account, and moves money or data. To every system involved, the clerk is doing the work.

Reading the three side by side shows why one control set never covers all of them. The malicious case wants monitoring and least privilege. The negligent case wants guardrails and training. The compromised case wants strong authentication and session hygiene. A program that only buys tools for one type leaves the other two open.

Why access and privilege are the whole game

The damage any insider can do is bounded by what their access lets them reach. This is the single most important idea in the entire subject, because it turns a vague fear into a concrete, reducible quantity.

An employee with access to one system can harm one system. An administrator with broad rights can harm everything. When you over-provision access, grant standing admin rights, or leave old permissions in place after a role change, you widen the blast radius of every insider incident before it happens. Most organisations accumulate access like clutter: people gather permissions across years and roles, and almost nobody removes them.

This is why least privilege is the foundational insider control. Granting only the access a person needs for their current job, and removing it when the need ends, shrinks what any single insider, malicious or compromised, can touch. Privileged accounts deserve special attention, which is the case for privileged access management: the small number of high-power accounts are where insider risk concentrates.

The same logic applies to the exit. A departing employee with lingering access is a classic insider risk, and rushed or incomplete offboarding is a recurring root cause. Access that outlives the job is an incident waiting for a motive.

The idea has a useful shorthand: blast radius. Every account carries a blast radius equal to everything it can reach and everything it can change. A help-desk account that can reset any password has a large blast radius even though the person is junior. A senior engineer with access scoped to one service has a small one. Insider risk management is largely the work of measuring these blast radii and shrinking the ones that are wider than the role requires. Standing administrative rights, shared privileged accounts, and permissions accreted across old roles are where the widest radii hide.

Why insiders are harder than outsiders

This category resists the usual toolkit for a structural reason. An external intrusion has a seam a defender can watch: the moment an attacker crosses from outside to inside. Exploits, brute force, and phishing all leave that seam. An insider begins on the inside, holding a valid credential, so there is no crossing to catch.

Property	External threat	Insider threat
Starting position	Outside the perimeter	Inside, with valid access
Primary signal	Intrusion, exploitation, anomalous entry	Misuse of legitimate access
Knowledge of the target	Learned during the attack	Already known from the job
Detection basis	Known-bad signatures and entry events	Deviation from an individual's normal behaviour
Strongest single control	Perimeter and authentication	Least privilege and access hygiene

The right-hand column explains the whole difficulty. There is no malware to match and no login to reject, because the login is real and the activity looks like work. Detection has to reason about behaviour and context rather than about known-bad artifacts, which is slower, noisier, and more dependent on knowing what normal looks like for each person.

What insider activity looks like

Because insiders use legitimate access, there is rarely a single alarm that says "attack". Instead there are deviations from normal behaviour. Useful indicators include:

Unusual access patterns. Reaching systems or data outside the person's role, or accessing far more than usual.
Volume anomalies. Large downloads, bulk exports, or copying data to removable media or personal cloud accounts. Exfiltration to an external service maps to Exfiltration Over Web Service (T1567) on MITRE ATT&CK.
Timing anomalies. Access at odd hours, or a spike in activity in the days around a resignation.
Circumvention. Attempts to disable logging, bypass controls, or move data through unmonitored channels.
Behavioural context. A documented grievance, sudden financial pressure, or a role change without a corresponding access change.

No single indicator is proof. A large download might be a legitimate backup. The value is in correlation: several weak signals from the same person over a short window is a far stronger signal than any one alone. The quality of that correlation depends entirely on the baseline. If normal is well understood for each role and each account, a deviation stands out cleanly. If access is sprawling and everyone can reach everything, almost nothing looks unusual, and the same indicators generate noise instead of leads. This is why access hygiene precedes detection rather than following it.

The resignation window is a real risk period

A recurring insider pattern is data theft in the final weeks of employment, when a departing person copies material they intend to take to a competitor. Access reviews triggered by resignation, and monitoring of bulk data movement during notice periods, catch a meaningful share of malicious insider cases. Build the trigger into your offboarding process, not into a person's memory.

Building a detection and prevention program

An insider threat program is a system, not a product. The technical pieces matter, and so do the process and governance around them.

User and entity behaviour analytics (UEBA) establishes a baseline of normal behaviour for each user and account, then flags deviations. Because it looks for anomalies rather than known-bad signatures, it can surface insider activity that no rule anticipated. It produces false positives, so it works best as a lead generator for human review rather than an automated verdict.

Data-loss prevention monitors and controls where sensitive data goes: blocking or flagging uploads to personal accounts, copies to removable media, or emails to external addresses. See What Is DLP. It is most effective against the negligent insider and the careless step of a malicious one.

Identity and access controls are the preventive backbone. Strong authentication limits compromised insiders, least privilege limits everyone, and disciplined offboarding closes the exit. A mature identity and access management foundation is what makes the detective controls tractable, because a smaller, cleaner access surface produces cleaner signals.

Process and governance tie it together. That means access reviews on a schedule and on role change, an offboarding checklist that revokes everything, manager involvement in flagging concerns, and a defined path for investigating an alert without prejudging the person.

Insiders are downstream of outside actors too

Compromised insiders are the point where external threat actors become inside threats. The credential theft and access-brokering that create them are tracked activity. Our Threat Groups directory profiles the actors who buy and abuse legitimate access, which is the same access an insider program is built to protect.

Walking an alert to a verdict

The value of a program shows in how it handles a single alert, so it helps to trace one through. Suppose UEBA flags an engineer for downloading an unusually large volume of records late at night, well outside their normal pattern.

Correlate before reacting. One anomaly is weak. The reviewer looks for other signals from the same person in the same window: recent access to systems outside their role, copies to removable media or personal cloud, or attempts to disable logging. Several weak signals together are far stronger than any one.
Add context, carefully. The reviewer checks neutral facts: is there a known deadline, a legitimate migration, an approved bulk job. Behavioural context such as a recent resignation matters, and it is treated as a reason to look, not as a conclusion.
Confirm the data path. Data-loss tooling shows where the records went. An internal backup target is very different from an upload to a personal account, and the destination often settles whether this is routine work or exfiltration mapping to Exfiltration Over Web Service (T1567).
Involve the right people. If the signal holds, the path runs through a defined process with manager and, where needed, legal and human-resources involvement. The person is not prejudged, and the investigation stays documented and proportionate.
Resolve and feed back. Whether the outcome is a benign explanation or a confirmed incident, the result tunes the baseline. False positives teach the system what normal looks like, and true positives inform the controls that should have prevented it.

The discipline in that sequence is what separates a fair, effective program from one that generates suspicion and noise. The tooling raises a hand. People decide what it means.

How insider programs mature

Programs do not arrive complete, and trying to deploy everything at once tends to produce noise no one can act on. A workable progression moves through stages.

The first stage is access hygiene. Before any monitoring, an organisation gets its arms around who can reach what, removes standing and orphaned permissions, and fixes offboarding so access ends with employment. This stage helps against external attackers too, and it produces the cleaner access surface that later detection depends on.

The second stage is privileged-account control. The small set of high-power accounts is where worst-case damage concentrates, so those accounts get strong authentication, session recording where appropriate, and tighter review. Concentrating early effort here buys the most risk reduction per unit of work.

The third stage is behavioural and data-movement monitoring. With a clean access surface and privileged accounts under control, UEBA and data-loss prevention produce signals that are meaningful rather than drowned in noise. Detection layered on a messy access surface generates alerts no one can triage.

The fourth stage is governance and culture. Clear policy, proportionate monitoring, manager involvement, and a defined investigation path make the program credible, legal, and sustainable. Without this stage the technical controls tend to be both unfair and brittle, and people route around them.

The order matters. Buying detection tooling before fixing access is the most common way these programs stall, because the tools then surface endless anomalies against a baseline no one trusts. A program that follows the stages in order spends less, alerts less, and catches more, because each layer sits on a foundation the one below it already cleaned up.

Getting the balance right

The failure mode of insider programs is over-surveillance. Monitoring employees as suspects damages trust, invites legal and privacy problems, and pushes people toward the workarounds that create risk in the first place. A credible program is proportionate and transparent about what is monitored and why, following a recognised control framework such as NIST SP 800-53 rather than improvising.

The practical priorities, in order:

Fix access first. Least privilege and clean offboarding remove the conditions most insider incidents depend on, and they help against outsiders too.
Protect and watch privileged accounts. The small set of high-power accounts is where the worst-case damage lives.
Add behavioural and data-movement monitoring. UEBA and DLP turn the remaining risk into signals a human can review.
Govern it fairly. Clear policy, proportionate monitoring, and a defined investigation process keep the program credible and legal.

Insider threats never fully go away, because access is the point of employing people. The realistic goal is to make the access smaller, the movement of data more visible, and the exit cleaner, so that a mistake, a grievance, or a stolen credential has less room to become a disaster.

Common misconceptions

"Insider threat means a disgruntled employee." The malicious insider is the smallest of the three groups. Negligent and compromised insiders drive a large share of real incidents, and they respond to different controls. A program built only around catching bad actors misses most of the actual loss.

"More monitoring is always better." Beyond a point, surveillance produces noise, erodes trust, and pushes people toward the workarounds that create risk. A flood of low-quality alerts also buries the few that matter. Proportionate monitoring focused on privileged accounts and sensitive data outperforms watching everyone equally.

"We can eliminate insider risk." Access is the reason people are employed, so the risk is inherent to the organisation. The goal is reduction and containment, shrinking blast radius and improving visibility, rather than a promise of zero.

"Technical controls are the whole answer." Tools produce signals, and people decide what they mean. Manager involvement, a fair investigation process, and clear policy are what turn a UEBA alert into a resolved case instead of an accusation. A program that is all tooling and no governance tends to be both unfair and ineffective.

"Compromised insiders are an external problem, not ours." The stolen credential lands inside your environment and behaves like an employee. Strong authentication, session controls, and least privilege are insider controls precisely because they bound what a hijacked account can do. Treating the compromised case as somebody else's problem leaves a wide gap that attackers walk through with a valid login.

Frequently asked questions

How is an insider threat different from an external attack?

An external attacker has to get in first, which creates an entry event a defender can watch for. An insider already holds legitimate access, so there is no intrusion to detect. The activity looks like ordinary work, which is why detection depends on spotting deviations from a person's normal behaviour rather than matching known-bad signatures.

Which insider type causes the most incidents?

Negligent and compromised insiders account for a large share of real-world cases, while deliberate malicious insiders are the minority by number. That distribution is why training, guardrails, and strong authentication matter as much as monitoring for bad intent. The severity picture can differ, since a single malicious insider who knows exactly where the valuable data sits can cause disproportionate damage.

What is UEBA and where does it fit?

User and entity behaviour analytics builds a baseline of normal activity for each user and account, then flags departures from it, such as unusual access, volume, or timing. Because it looks for anomalies rather than known signatures, it can surface insider activity no rule anticipated. It generates false positives, so it works best as a lead generator for human review rather than as an automatic verdict.

Why is offboarding treated as a security control?

Access that outlives the job is a standing risk with no owner. A departing person with lingering permissions is a classic malicious-insider case, and the notice period is a documented window for data theft. Building access revocation and access review into the offboarding process, triggered automatically rather than left to memory, closes the exit before it can be used.

Does an insider threat program mean spying on employees?

A credible program is proportionate and transparent. It concentrates on privileged accounts and sensitive-data movement, states clearly what is monitored and why, and follows a recognised control framework such as NIST SP 800-53. Over-surveillance backfires, damaging trust and pushing people toward risky workarounds, so restraint is part of the design.

What single control reduces insider risk the most?

Least privilege. The damage any insider can do is bounded by what their access can reach, so granting only what a role needs, and removing it when the need ends, shrinks the blast radius of every insider incident, malicious or compromised, before it happens. It also strengthens defence against external attackers who land on a legitimate account.

How do compromised insiders relate to external threat actors?

They are the bridge between the two. When an outsider steals a credential or hijacks a session, that access behaves like an insider from the system's point of view. The credential theft and access brokering that create compromised insiders are tracked criminal activity, which is why strong authentication and session controls are core to any insider program.