Topic starter
08/01/2026 12:46 pm
TL;DR: Insider threats are still identity problems in cloud environments because negligence, credential theft, and malicious misuse all move through access paths and privilege, according to Veza. IBM puts malicious-insider breach cost at $4.92 million on average, while Ponemon and DTEX place annual insider-risk cost at $17.4 million, making governance over access and response the real control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “When Identities Turn Against You: Building an Insider Threat Program for the Cloud Era”.
By the numbers:
- In 2025, insider risks cost organisations an average of $17.4 million annually, according to Veza.
Key questions
Q: What breaks when insider threat detection is not identity-aware?
A: Perimeter tools miss the difference between legitimate work and harmful activity when the account itself is trusted.
Q: Why do standing privileges make insider misuse so damaging?
A: Standing privileges extend the time window in which a valid identity can perform sensitive actions.
A: Warning signs include access that has not been recertified, old permissions that remain in place after role changes, weak monitoring of contractors, and approvers who can also approve their own access.
Practitioner guidance
- Build a unified identity inventory Catalog employees, contractors, service accounts, shared accounts, dormant accounts, and privileged roles so insider-risk controls can operate on a complete access picture.
- Replace standing privilege with JIT elevation Use time-bound, approver-gated privilege for admin and developer roles, and remove permanent elevation paths wherever the access need is episodic.
- Bind access reviews to high-risk identities Prioritise recurring reviews for privileged humans and NHI accounts with broad access, then revoke stale entitlements before they become incident paths.
Bottom line: Insider threat in the cloud is best understood as identity misuse across humans, contractors, and compromised accounts, not as a standalone behavior problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:15 pm
Insider threat is an identity governance problem before it is a behavioral one. The article correctly frames negligence, credential theft, and malicious misuse as different expressions of the same access problem. In cloud environments, identity is the path, the permission set, and the response boundary, so insider programs must be designed around entitlement control and identity visibility rather than incident reaction alone.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Security teams should treat early insider threat indicators as a coaching and verification opportunity, not only a disciplinary event. Start by asking for context, reminding the user of policy, and checking whether the behavior has a legitimate explanation. If the activity continues after a clear warning, preserve evidence and escalate through HR and the insider threat process.
👉 Read our full editorial: Identity-centric insider threat programs need cloud-era governance