Insider recruitment now targets workflows, not just privilege

At a glance

What this is: This is an Intel 471 analysis of the underground market for insider access, showing that adversaries are recruiting workers for specific workflows rather than only pursuing high-privilege accounts.

Why it matters: It matters because IAM, PAM and insider risk programmes that focus only on privileged users can miss the employees whose legitimate actions create the most exploitable business impact.

By the numbers:

• Intel 471 analyzed 85 insider-related leads tied to 80 actor handles collected across criminal forums, Telegram groups, messaging platforms and marketplaces.
• Recruitment accounted for 53% of observed records, ahead of claimed insider access, insider-enabled services and data sales.
• Transportation appeared in 22% of leads, technology in 20% and telecommunications in 18%.

Context

Insider risk is no longer defined only by disgruntled employees, departing contractors or overt credential theft. The more consequential problem is that attackers can recruit, broker and operationalise legitimate workers whose normal duties enable account changes, payment actions, logistics decisions or verification steps.

This article sits at the intersection of insider threat, IAM and NHI governance because the abuse path is not necessarily a stolen password. It is the misuse of legitimate access, workflow authority and business process trust, which means identity controls alone are not enough unless they are tied to task criticality and action-level oversight.

For identity teams, the relevant question is which roles can change state in ways an outsider would value. That is a broader governance problem than classic privileged access management, and it is typical of modern insider markets rather than an edge case.

Key questions

Q: What breaks when insider risk programmes only cover privileged users?

A: They miss the employees whose everyday workflow authority can be more valuable to attackers than admin access. Account recovery, SIM swaps, shipment holds and moderation actions can all be abused through legitimate permissions, so a narrow privileged-user model leaves the most recruitable roles outside the control boundary.

Q: Why do workflow roles attract insider recruitment?

A: Because they let an outsider turn one legitimate employee action into repeated criminal value. A support reset, billing change or identity verification override can be monetised many times, which makes these roles more attractive than raw credential access when adversaries are building an insider market.

Q: What are the signs that an insider market is targeting your organisation?

A: Look for recruitment posts, broker offers and service advertisements that name your brands, roles, workflows or locations. The strongest signal is not proof of a planted insider, but repeated demand for the exact business function that would let an outsider change state inside your processes.

Q: How should organisations reduce insider abuse without blocking legitimate work?

A: Use segregation of duties, secondary approval and behaviour monitoring around high-impact actions rather than broad access removal. The aim is to preserve the workflow while making one person’s legitimate session insufficient to complete a high-risk change on its own.

Technical breakdown

Why workflow access has become a criminal commodity

Underground insiders are valuable when they can execute a business action that is hard for outsiders to replicate. A support agent can reset credentials, a telecom worker can trigger a SIM swap, a logistics employee can alter shipment status, and a moderator can reinstate an account. The market is therefore built around workflow outcomes, not just data theft. That changes the control problem: the attacker does not need root access if a legitimate function already has the authority to alter identity, money, or service state. Those functions become reusable capabilities that can be sold repeatedly.

Practical implication: map high-value workflows, not just privileged accounts, and treat state-changing actions as governance objects.

How brokers and recruiters industrialise insider access

The underground market now includes recruiters, brokers and service providers that separate the buyer from the employee. Recruitment-as-a-service creates a supply layer where actors identify targets, approach them, and convert them into insiders without direct criminal contact at the point of sale. That matters because security teams often search for a signed insider or a credential leak, while the adversary is still building the relationship. Once the relationship is established, the seller can package repeatable access, staged actions, or ongoing service delivery across multiple customers.

Practical implication: extend detection beyond exfiltration and watch for recruitment patterns that target your staff and workflows.

Why the best signal is often legitimate action misuse

Insider-enabled abuse rarely depends on malware or broken authentication. It depends on a normal employee using legitimate permissions in an unusual way, at an unusual time, or for an unusual beneficiary. That creates a governance blind spot because identity systems may see an authenticated, authorised action while the business context is fraudulent or coerced. Security monitoring therefore has to combine identity, role, workflow and behavioural context. In NHI terms, the same principle applies to service accounts and bots: legitimate authority can still be abused when task scope is too broad or poorly segmented.

Practical implication: monitor for anomalous use of legitimate functions, especially where a single action can change accounts, payments or logistics state.

Threat narrative

Attacker objective: The attacker wants repeatable insider-enabled capability that can be sold, reused or operationalised without needing direct technical compromise.

1. Entry begins with recruitment, brokerage or deceptive employment placement that gives an external actor influence over a worker with useful business access.
2. Credential access is not always the point. The attacker instead gains workflow authority through the insider’s legitimate permissions, approvals or reset capabilities.
3. Escalation occurs when that legitimate function is converted into repeatable criminal capability, such as account manipulation, SIM swaps, shipment changes or data retrieval.
4. Impact is the sale or reuse of insider-enabled services across multiple buyers, turning ordinary staff activity into fraud, intrusion or intelligence collection.

Breaches seen in the wild

• Coinbase insider bribery breach 2025: Criminals bribed overseas Coinbase support agents to copy data on 69,461 customers, then tried to extort $20 million.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Workflow authority is the real insider risk surface: the article shows that adversaries value the employee who can change a state, not only the employee with elevated system privilege. That broadens insider risk from an HR and ethics concern into an identity governance problem. Organisations that scope insider controls only to administrators miss the people whose normal duties can reset, reroute or reclassify access, money or goods.

Insider programmes need a supply-chain view of human compromise: the underground market now has recruiters, brokers and service providers, which means the adversary may be two steps removed from the employee doing the abuse. That mirrors a broader governance pattern in which access is acquired through delegation, coercion or recruitment rather than theft. The practical conclusion is that insider detection must watch for the market conditions that precede abuse, not just the abuse itself.

Least privilege is necessary but no longer sufficient: when a single legitimate function can create outsized impact, privilege scope alone does not capture the risk. Segregation of duties, secondary approval and action-level monitoring become the decisive controls because they constrain what one person can do with a legitimate session. In NHI and human IAM alike, the governance unit is the action, not merely the account.

Recruitment resilience is now part of security governance: the article makes clear that financial stress, role visibility and public staff data are inputs to insider targeting. That means security teams should treat employee exposure, role signalling and workflow criticality as part of their threat model. The organisation that understands which workflows are recruitable is better positioned to harden them before they are monetised externally.

Shadow insider markets expose a verification gap: the most dangerous insider may never advertise as an insider at all, because the role can be acquired through job placement, brokerage or service outsourcing. That means threat intelligence should feed directly into identity governance, workforce risk and fraud controls. Practitioners should assume the adversary is shopping for business process authority, not just credentials.

What this signals

Workflow-centric insider risk is a governance shift, not just a threat trend: programmes built around administrator abuse need to expand to the people who operate customer support, verification, logistics and payment workflows. Those roles sit closer to business state than many technical accounts, so they create a more durable insider attack surface than teams often model.

Security teams should treat recruitability as a control signal: the combination of public role visibility, repetitive approval power and easy-to-monetise actions makes some staff far more attractive to brokers than others. That means insider resilience starts with knowing which workflows are worth buying, then reducing the operational value of a single compromised or recruited employee.

Business process abuse is the missing category in many identity programmes: when a legitimate user can reroute goods, reset access or approve exceptions, the security issue is not simple authorisation failure. It is a trust boundary problem between identity, process and fraud control, and that boundary needs to be explicit in programme design.

For practitioners

• Map recruitable workflows, not just privileged roles Identify jobs whose legitimate actions can reset identity, move money, alter shipments or change account state, then rank them by outsider value.
• Separate high-risk functions with approval gates Require secondary approval for state-changing actions such as account recovery, SIM swap requests, shipment holds and identity verification overrides.
• Monitor for insider recruitment signals Track posts, messages and broker offers that mention your brands, staff roles, support functions or operational workflows, and route them into threat intelligence triage.
• Reduce public staffing intelligence Limit the exposure of role, team and contact details that make it easier for brokers to profile likely targets and approach them as a lifeline.
• Baseline unusual use of legitimate functions Alert on abnormal approval patterns, repeated exception handling, off-hours workflow changes and requests that are valid in form but suspicious in context.

Key takeaways

• The core risk is not only hostile employees, but a market that recruits workers whose normal duties can be turned into criminal capability.
• Intel 471’s sample of 85 insider-related leads shows recruitment is the dominant activity, which supports the shift from static insider assumptions to active adversary sourcing.
• The most effective response is to govern recruitable workflows with segregation of duties, secondary approval and monitoring for unusual legitimate actions.

Key terms

• Insider-Enabled Service: A legitimate business function that an attacker can buy, broker or co-opt through a worker who already has the authority to perform it. The service may look normal from the inside, but its value lies in the ability to change account, payment or logistics state for criminal use.
• Recruitment-as-a-Service: An underground model where brokers and intermediaries find or persuade workers to become insiders on behalf of buyers. The criminal customer does not need direct contact with the employee, which makes the abuse harder to detect and allows the same access path to be reused across multiple transactions.
• Workflow Authority: The set of actions an identity is allowed to initiate, transform, or commit inside a business process. For agents and non-human actors, authority should be defined by workflow step, not by broad application access, because the control risk sits in what the actor can change, not just what it can open.
• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It gives practitioners a common control language for identity risk across human, service and agentic contexts.