Insider Threat

Insider threats come in three broad flavours: malicious insiders (deliberately stealing data for financial gain, espionage or sabotage), negligent insiders (bypassing controls out of convenience, mishandling data accidentally) and compromised insiders (whose credentials have been taken over by an external attacker). The Ponemon Institute's annual Insider Threat Report consistently finds that insider-caused incidents are among the costliest categories, and they are often the slowest to detect because the activity looks like normal authorised use.

Controls against insider threat combine technical layers (User Behavior Analytics, DLP, access governance, PAM, logging) with organisational practice (separation of duties, mandatory time off, joiner-mover-leaver automation, security awareness training). Under GDPR Article 32 and DPDP Section 8(5), the insider-threat posture is part of the 'reasonable security safeguards' assessment. For privacy specifically, insider misuse is a notifiable breach the moment it crosses into unauthorised personal-data access — the fact that the actor is authorised to the system does not immunise the Fiduciary from the notification obligation.