Notifications
Clear all
08/06/2026 9:08 am
Insider threat is really an entitlement governance failure. The article correctly shows that insiders are not only malicious employees. They are any authorised identity whose access scope exceeds what the organisation can safely observe, justify, or revoke. The governance lesson is that identity trust cannot stop at authentication. Practitioners need to treat every broad entitlement as a latent insider pathway.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Who should be accountable when an insider misuses authorised access?
A: Accountability sits with the organisation that granted and failed to govern the access, not only with the individual actor. Security, IAM, PAM, data owners, and business managers all share responsibility for scoping, reviewing, and revoking access. Regulators and auditors will usually ask whether control ownership was clear before the incident occurred.
👉 Read our full editorial: Insider threat governance is really access governance
