Topic starter
18/08/2026 2:55 pm
TL;DR: Trusted users, contractors and compromised accounts can move data through routine workflows, Strac notes, making insider threats hard to spot across cloud, gen AI and SaaS. Content-aware enforcement and tighter entitlements are needed to reduce exposure before access turns into loss.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “A Guide to Insider Threat Prevention Across Cloud, Gen AI, and SaaS Environments”.
By the numbers:
- Every year, over 34% of businesses globally are impacted by insider threats, according to Strac.
- Identifying and containing an insider threat takes around 85 days, according to Strac.
Key questions
Q: Why do authorised users create more insider risk than external attackers?
A: Authorised users already sit inside the trust boundary, so their actions often bypass the obvious controls used against outside attackers.
Q: How can security teams tell whether DLP is actually reducing risk?
A: Look for better prioritisation of high-value data, fewer noisy alerts, and clearer visibility into which identities can reach sensitive content.
Q: What breaks when organisations rely only on access-based controls to catch insider threats?
A: Access-based controls miss the gap between legitimate permission and risky intent.
Practitioner guidance
- Implement content-aware DLP policies Classify sensitive data and enforce block, warn or audit actions at the point of transfer across email, browser, chat and SaaS channels.
- Tighten access for third-party insiders Review partner, contractor and vendor entitlements separately from employee access and remove any standing permissions that are not essential.
- Correlate identity and activity telemetry Pair access reviews with behavioural monitoring so unusual downloads, off-hours activity and unexpected destinations are visible together.
Bottom line: Insider threat risk persists because trusted users, contractors and compromised accounts can move data through normal business workflows.
Glossary terms: Insider Threat Detection, Data Loss Prevention, Compromised Insider, Third-Party Insider
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:37 pm
Insider threat is now an access governance problem, not just a behavioural anomaly problem. The article’s core tension is that malicious, negligent, compromised and third-party insiders all operate through permissions the business has already granted. That means entitlement design, offboarding discipline and channel-level controls matter more than after-the-fact suspicion. Practitioners should treat insider risk as a lifecycle control issue, not a pure monitoring exercise.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: Who is accountable for insider threat prevention across cloud, gen AI and SaaS?
A: Accountability should sit jointly with identity, security and data governance leaders, because the risk crosses entitlements, content and telemetry. IAM owns who can reach what, DLP and data security own how data is handled, and SOC or platform teams own detection and response. Shared ownership only works when policy, review and enforcement are aligned.
👉 Read our full editorial: Why insider threat prevention must join access, data and identity
This post was modified 1 day ago by NHI Mgmt Group