Topic starter
23/10/2026 12:47 am
TL;DR: Insider threats slip past DLP, EDR and SIEM when legitimate access and cross-system activity look normal, according to Vectra AI. Identity correlation across cloud, SaaS and collaboration tools is what security teams need to spot intent before data is staged or removed.
Editorial analysis by NHI Mgmt Group, based on content published by Vectra AI: “Why insider threats go undetected by security tools and How Behavioral AI Closes the Gap”.
By the numbers:
- Malicious insider attacks cost an average of $4.92 million and take 260 days to resolve, according to IBM's Cost of a Data Breach 2025 report cited by Vectra AI.
- Across active Vectra AI customer deployments, nearly 4 in 10 of the prioritized threats were insider threats within a one-month period.
Key questions
Q: Why do data sprawl and generative AI increase the risk of insider-driven breaches?
A: Data sprawl and generative AI expand the number of places sensitive information can move and the number of paths it can leave by.
Q: How do security teams tell compromise from malicious insider behaviour?
A: By evaluating behaviour over time rather than a single event.
Q: What breaks when insider risk tools rely only on DLP or endpoint monitoring?
A: DLP and endpoint tools can miss the broader context that shows intent and escalation.
Practitioner guidance
- Map insider-risk detection to identity sequences Correlate mailbox rules, unusual downloads, permission changes and cross-system searches into one case view so analysts can see intent, not just isolated alerts.
- Treat AI-assisted search as a governed access path Define review and monitoring for Copilot-style queries across mail, documents and chat because discovery speed changes the risk profile of existing permissions.
- Extend visibility across identity and collaboration platforms Unify telemetry from Active Directory, Entra ID, M365, SharePoint, Exchange and cloud resources so benign-looking actions can be evaluated together.
Bottom line: Insider threats succeed because they operate inside trusted access paths, which makes behaviour more important than the simple existence of permissions.
Glossary terms: Insider Threat Detection, Behavioral Detection, Generative AI-Assisted Reconnaissance, Identity correlation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Insider threat is an access governance problem before it is a detection problem: the actor already sits inside the trust boundary, often with privileged access and legitimate tooling. That means the real failure is assuming that valid authentication equals safe behaviour. The implication is that identity governance has to judge how access is used, not only whether it was granted.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: The first priority is to establish clear data governance for the environments people use most. Define which tools are sanctioned, what data belongs in each one, and who is allowed to share it. Then reinforce those rules with training and visibility controls such as cloud DLP. Without that foundation, even well-intended users can create avoidable exposure.
👉 Read our full editorial: Insider threats outpace prevention-only controls in identity environments
This post was modified 6 days ago by NHI Mgmt Group