Insider threats: are your identity controls seeing the full picture?

TL;DR: Insider threats increasingly evade DLP, EDR and SIEM because legitimate permissions and cross-system activity blend into normal workflows, according to Vectra AI, while IBM says malicious insider attacks average $4.92 million and take 260 days to resolve. Identity-based behavioral detection is now the only practical way to surface intent before data leaves.

Editorial analysis by NHI Mgmt Group, based on content published by Vectra AI: “Why insider threats go undetected by security tools and How Behavioral AI Closes the Gap”.

By the numbers:

• Malicious insider attacks cost an average of $4.92 million and take 260 days to resolve, according to IBM's Cost of a Data Breach 2025 report cited by Vectra AI.
• Across active Vectra AI customer deployments, nearly 4 in 10 of the prioritized threats were insider threats within a one-month period.

Key questions

Q: What breaks when insider risk tools rely only on DLP or endpoint monitoring?

A: DLP and endpoint tools can miss the broader context that shows intent and escalation.

Q: Why do data sprawl and generative AI increase the risk of insider-driven breaches?

A: Data sprawl and generative AI expand the number of places sensitive information can move and the number of paths it can leave by.

Q: How do security teams tell compromise from malicious insider behaviour?

A: By evaluating behaviour over time rather than a single event.

Practitioner guidance

• Map insider-risk detection to identity sequences Correlate mailbox rules, unusual downloads, permission changes and cross-system searches into one case view so analysts can see intent, not just isolated alerts.
• Treat AI-assisted search as a governed access path Define review and monitoring for Copilot-style queries across mail, documents and chat because discovery speed changes the risk profile of existing permissions.
• Extend visibility across identity and collaboration platforms Unify telemetry from Active Directory, Entra ID, M365, SharePoint, Exchange and cloud resources so benign-looking actions can be evaluated together.

Bottom line: Insider threats succeed because they operate inside trusted access paths, which makes behaviour more important than the simple existence of permissions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →