Because the organisation is still learning the person’s normal behaviour while often giving them broad initial access and lighter monitoring. That makes early activity hard to classify and gives a malicious insider a short but valuable window to exfiltrate data or establish trust. The risk is highest when onboarding and access governance are not tightly linked.
Why the first 90 days are a distinct insider-risk window
The early employment window is risky because access, habits, and oversight are all still settling. A new joiner may be legitimate, but the organisation has less behavioural baseline, less process maturity around their access, and often more permissive onboarding defaults. That combination creates a short period where harmful action, or simple mistakes with security impact, can be harder to distinguish from normal work.
What makes this period different from steady-state insider risk is not just the person, but the operating model around them. Onboarding tends to prioritise productivity, so accounts, entitlements, shared tools, and data access may be provisioned faster than they are reviewed. In parallel, managers and security teams often have limited evidence for what “normal” looks like for that role, which weakens anomaly detection and human challenge.
The window matters because insiders do not need long dwell time to cause damage. Early access can be enough to copy data, map systems, export contacts, or establish trust relationships before tighter review catches up. For that reason, many security teams treat the first quarter as a transition period where access, monitoring, and line-manager oversight should evolve together rather than separately.
How onboarding and access governance create the exposure
The risk is usually created by mismatched timing. HR may record the hire, IT may provision access, the manager may approve broad entitlements, and security may only later see whether those permissions were justified. If joiner workflows are not tied to role design and least privilege, the new starter can inherit access that is wider than needed for the first tasks, or wider than the role truly requires.
That is why identity governance discipline matters even when the question is about insider risk rather than identity management itself. Access should be deliberately staged, with stronger controls around privileged systems, sensitive datasets, and export paths. NHIMG’s Insider Threat and Identity Guide is useful here because it ties least privilege, behavioural monitoring, and leaver risk to the insider problem directly.
Behavioural uncertainty is the other half of the problem. In the first 90 days, unusual logins, odd file access, or attempts to reach unfamiliar systems may still be innocent onboarding activity. That ambiguity can delay response, especially where security operations lack role-specific baselines or where the hiring manager is the only person who can quickly validate whether an action is expected. NIST Cybersecurity Framework 2.0 is a useful anchor for thinking about this as a govern-protect-detect problem rather than a single control problem.
What this means for practitioners during the joiner period
The first priority is to narrow initial access to the smallest practical set, then widen it only when the work proves it is needed. That is more effective than giving broad access up front and hoping monitoring compensates later. It also reduces the chance that an early malicious insider can reach high-value data before their access pattern becomes visible.
What to verify: check whether the joiner has been placed into a role-defined access bundle, whether any privileged or export-capable permissions are temporary, and whether someone outside the direct line manager can review unusual access early in tenure. If the answer to any of those is unclear, treat the account as higher risk until the access path is explained.
Decision rule: if a new hire can reach sensitive data, administrative functions, or large-scale export paths on day one, review the entitlement set before relying on behavioural monitoring. Monitoring can support detection, but it should not be the primary control that makes the access acceptable.
What good looks like: the organisation can show a tighter first-90-days access profile, a defined approval path for exceptions, and a mechanism for quickly comparing observed behaviour against the job role. NHIMG’s Agentic AI Identity Risk Board Briefing is a useful analogue for the governance discipline of setting a 90-day plan, even though the subject here is human insider exposure rather than AI.
Practitioner takeaway: the first 90 days are risky because onboarding optimises for productivity before trust is fully earned, so the safest posture is staged access, explicit ownership, and early behavioural review rather than broad default permissions.
Risk and Threat Considerations
The main exposure is not that every new employee is suspicious, but that the organisation has a temporary blind spot. A malicious insider can use that period to blend in, and an unintentional insider can leak data simply by following broad access paths that were never intended to be permanent. In both cases, the organisation’s weak point is the gap between granting access and truly understanding how the person will use it.
Failure mechanism: joiner access is often granted before role-specific baselines, manager oversight, and entitlement trimming are fully established. That creates a short-term opportunity for exfiltration, privilege discovery, or trust-building before detection becomes reliable.
Impact: the likely outcomes are data loss, unauthorized access to sensitive systems, delayed detection, and higher investigation complexity because early activity is harder to classify confidently.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Joiner access and early entitlement review are core account-management controls. |
| Recommendation — Restrict initial access, review exceptions quickly, and remove permissions that are no longer needed. | ||
| NIST CSF 2.0 | PR.AA-01 — Identities and Credentials Are Issued, Managed, Verified, Revoked, and Audited | The first 90 days expose gaps in identity lifecycle and access governance. |
| Recommendation — Manage joiner identities and access through explicit issuance, verification, and timely revocation. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | New-hire exposure depends on account provisioning, review, and deprovisioning discipline. |
| AC-6 — Least Privilege | Early broad access is the main exposure described in the question. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Early behaviour is hard to classify, so review and analysis are needed for detection. | |
| Recommendation — Provision only role-needed accounts and review standing access early in tenure. Limit new-hire permissions to the minimum access needed for the role. Review early activity for unusual patterns and escalate exceptions quickly. | ||
Practitioner Guidance
Where to start: separate the first-90-days access model from steady-state access review. Put temporary approvals, expiry dates, and explicit exception ownership around any permission that exceeds the minimum role requirement.
What to measure: track how many new-hire accounts still have elevated or cross-domain access after the first few weeks, and how quickly exceptions are reviewed or removed. A long tail of unreviewed access is a stronger signal than one isolated odd event.
Common mistake: assuming that good onboarding equals low insider risk. Onboarding speed and security often pull in opposite directions, so the control objective is not to slow hiring, but to make early access more observable and more tightly bounded.
Practitioner takeaway: if the organisation cannot explain why a new hire needs each higher-risk permission during the first quarter, the access model is probably driving risk faster than the monitoring stack can offset it.