Topic starter
18/08/2026 2:55 pm
TL;DR: Insider threats span malicious, negligent, compromised, and third-party insiders across cloud, gen AI, and SaaS, and Strac’s guide argues that prevention depends on combining access control, monitoring, and data loss prevention, with 34% of businesses globally impacted each year according to the article. The governance gap is that legitimate access is often broader, longer-lived, and harder to observe than teams assume.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “A Guide to Insider Threat Prevention Across Cloud, Gen AI, and SaaS Environments”.
By the numbers:
- Every year, over 34% of businesses globally are impacted by insider threats, according to Strac.
- Identifying and containing an insider threat takes around 85 days, according to Strac.
Key questions
Q: What breaks when organisations rely only on access-based controls to catch insider threats?
A: Access-based controls miss the gap between legitimate permission and risky intent.
Q: Why do authorised users create more insider risk than external attackers?
A: Authorised users already sit inside the trust boundary, so their actions often bypass the obvious controls used against outside attackers.
Q: How can security teams tell whether DLP is actually reducing risk?
A: Look for better prioritisation of high-value data, fewer noisy alerts, and clearer visibility into which identities can reach sensitive content.
Practitioner guidance
- Implement content-aware DLP policies Classify sensitive data and enforce block, warn or audit actions at the point of transfer across email, browser, chat and SaaS channels.
- Tighten access for third-party insiders Review partner, contractor and vendor entitlements separately from employee access and remove any standing permissions that are not essential.
- Correlate identity and activity telemetry Pair access reviews with behavioural monitoring so unusual downloads, off-hours activity and unexpected destinations are visible together.
Bottom line: Insider threat risk persists because trusted users, contractors and compromised accounts can move data through normal business workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:37 pm
Insider threat is now an access governance problem, not just a behavioural anomaly problem. The article’s core tension is that malicious, negligent, compromised and third-party insiders all operate through permissions the business has already granted. That means entitlement design, offboarding discipline and channel-level controls matter more than after-the-fact suspicion. Practitioners should treat insider risk as a lifecycle control issue, not a pure monitoring exercise.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: Who is accountable for insider threat prevention across cloud, gen AI and SaaS?
A: Accountability should sit jointly with identity, security and data governance leaders, because the risk crosses entitlements, content and telemetry. IAM owns who can reach what, DLP and data security own how data is handled, and SOC or platform teams own detection and response. Shared ownership only works when policy, review and enforcement are aligned.
👉 Read our full editorial: Insider threat prevention across cloud, gen AI and SaaS environments