An insider threat is the risk that a person with legitimate access misuses it through malice, fraud, or careless mistakes.
The person may be an employee, a contractor, or a partner, and the access was granted on purpose before the harm began.
How it works
Malicious insiders may steal data, sabotage systems, or sell access, while careless insiders mishandle files, fall for a trick, or reuse a password.
Fraud by an employee who can approve payments is an insider problem even when no external exploit is involved.
Because the activity starts from an allowed account, ordinary perimeter blocks may never see it.
Useful defense watches unusual use of allowed access, separates duties, and removes rights quickly when a role ends.
Concrete examples
- A departing salesperson downloads the entire customer list to a personal drive the week before the resignation date.
- A payroll clerk changes a bank account on a vendor record and approves the next payment without a second person.
- An administrator pastes a production database into a public chat while trying to get help with a query.
Protective measures
- Separate duties so one person cannot both create a payee and approve the payment alone.
- Alert on large exports, mass downloads, and access that falls outside a person's normal hours and systems.
- Remove access the day a contract or employment ends, and collect tokens and shared secrets in the same motion.
- Give people an easy way to report a mistake so concealment does not turn a small error into a larger incident.