Insider risk is the chance that someone the organisation has trusted with access, whether an employee, contractor, outsourced agent or a fraudulent hire, causes serious harm with that access. It rarely shows up in a penetration test, it often crosses HR, legal and security lines that no single executive owns, and when it goes wrong the cost can run to hundreds of millions. This briefing is for board members, executive committees and the CISO, general counsel and HR director who brief them. It sets out why insider risk belongs on the board agenda, the questions directors should ask, the answers that should worry them, and a 90-day plan. Programme design detail lives in the linked practitioner guides.
The risk in one paragraph
CISA defines an insider as anyone who has or had authorised access to or knowledge of an organisation's resources, and insider threat as the risk that an insider uses that access, wittingly or unwittingly, to do harm. The UK National Protective Security Authority (NPSA) changed its definitions in May 2023 to cover accidental as well as deliberate harm, with the message "if you have people, you have risk". For a board the exposure falls into four groups: malicious insiders who steal data or sabotage systems for gain or grievance, collusive insiders paid or pressured by criminals, fraudulent hires who were never who they claimed to be, and careless insiders whose mistakes expose data. Because all four use legitimate access, perimeter controls do not stop them. What stops them is limiting what each role can reach, noticing unusual use quickly and removing access the moment it is no longer needed.
Why this is a board-level issue now
- Bribed staff now come with a price list: in the Coinbase insider breach of 2025, criminals paid overseas support staff and contractors to copy data on 69,461 customers. The company estimated remediation and voluntary reimbursement costs at about USD 180 million to 400 million in its SEC filing, and refused a USD 20 million extortion demand.
- Fraudulent remote hires are a national security issue: on 30 June 2025 the US Department of Justice announced searches of 29 suspected laptop farms across 16 states and said North Korean IT workers had obtained remote jobs at more than 100 US companies. In one case workers accessed a defence contractor's files containing ITAR-controlled technical data. See the Insider Threat from Fake IT Workers Guide.
- Outsourcing moves insiders outside your walls: CISA lists third-party contractors and vendors as a distinct insider type. Outsourced support, development and operations staff often hold broad access with lighter vetting and monitoring.
- Access outlives employment: both definitions above include people who formerly held access. Accounts, tokens and keys that survive a leaver are insider risk with no one watching.
- Monitoring raises legal and cultural questions: employee monitoring must be lawful and proportionate. In the UK the ICO publishes specific guidance on monitoring workers. Getting this wrong creates its own liability, which is why the board should set the boundaries rather than leave them to the security team.
Five questions for the board to ask
- Who owns insider risk, and does that person have HR, legal and security at the same table? A credible answer names an accountable executive and a standing working group with HR, legal, security, IT and the business, meeting on a fixed cycle.
- Which roles could cause the most harm in a day, and what limits their reach? Expect a list of high-impact roles (administrators, support agents with bulk record access, finance approvers, engineers with production keys) and the specific limits on each, such as record-level access, approvals and session recording.
- How would we know if a support agent or contractor started copying customer records in bulk? The right answer describes alerts on unusual volumes, who reviews them and how quickly, not just a data loss prevention licence.
- How do we confirm a remote hire is who they say they are, and that the laptop we ship stays with them? Look for live identity verification at hiring, checks at the first day, device location and remote access tool controls, and payroll and address consistency checks.
- When someone leaves, how long until every account, token and key they could use is dead? A good answer is measured in hours for high-risk roles and covers non-human credentials the person created or knew, not only their directory account.
Red flags in management answers
- "We trust our people": trust is not a control, and the definitions cover careless and coerced staff, not only bad actors.
- "Security handles that": insider cases involve employment law, privacy and sometimes law enforcement; a security-only programme stalls at the first real case.
- "Our outsourcer is responsible for its staff": the data and the liability remain yours, as the Coinbase case shows.
- "We monitor everything": blanket monitoring is likely to be disproportionate and produces alerts no one reviews.
- No numbers on leaver access: if management cannot say how quickly access is removed, it probably is not.
What good looks like
| Area | Weak position | Good position |
|---|---|---|
| Ownership | Left to the CISO alone | Named executive owner, cross-functional working group, board reporting twice a year (our recommended minimum) |
| Access design | Broad role access, standing administrator rights | Least privilege by role, record-level limits for support tools, just-in-time administrator access |
| Hiring and vetting | Document checks only, remote onboarding by email | Live identity verification, checks proportionate to role, re-verification for sensitive roles |
| Detection | DLP alerts with no owner | Defined indicators, behaviour baselines for high-risk roles, named reviewers and response times |
| Third parties | Contract clause only | Named accounts for outsourced staff, your own monitoring of their access, right to audit |
| Leavers | Directory account disabled eventually | Same-day removal of all human and non-human access for high-risk roles, with evidence |
| Case handling | Ad hoc, inconsistent | Documented process from alert to closure, legal review, evidence handling and fair treatment |
For the full operating model see the Insider Threat Programme Guide and, to benchmark where you are, the Insider Risk Maturity Model.
Where to invest first
- Cut the reach of high-impact roles: record-level access and approvals in support, finance and production tooling reduce what any one insider can take. This is usually cheaper than detection and works against every insider type. See the Privileged Access Management Guide.
- Close the leaver gap: tie HR leaver events to automated removal of accounts, tokens and keys. See the Employee Offboarding Security Guide.
- Harden remote hiring: live identity checks and device controls address the fraudulent hire threat that traditional screening misses.
- Targeted detection: behaviour analytics focused on high-risk roles and bulk data access, with a person accountable for every alert. See the UEBA Guide.
- Govern outsourced access: named accounts, your own logging and periodic access reviews for contractor and outsourcer staff.
Metrics
| Metric | What it shows | Direction |
|---|---|---|
| Median time to remove all access for leavers in high-risk roles | Whether former insiders keep a door open | Down, target same day |
| Accounts with standing administrator rights | Size of the high-impact insider population | Down |
| Bulk data access alerts reviewed within the agreed time | Whether detection is acted on | Up, towards 100% |
| Outsourced staff accounts with named owners and recent access review | Third-party insider coverage | Up |
| Remote hires passing live identity verification before access | Fraudulent hire defence | Up, towards 100% |
| Insider cases opened, closed and median days to close | Programme throughput and fairness | Stable, with falling time to close |
A 90-day plan
- Days 1 to 30, ownership and exposure: appoint the executive owner, form the working group with HR, legal, security and IT, and list the twenty roles that could cause the most harm in a day. Agree the lawful basis and limits for monitoring with legal and, where relevant, employee representatives.
- Days 31 to 60, quick reductions: remove standing administrator rights that are not needed, apply record-level limits to the main customer support tools, connect HR leaver events to automated access removal and add live identity checks to remote hiring.
- Days 61 to 90, detection and reporting: turn on bulk access alerts for high-risk roles with named reviewers, run a tabletop exercise on a bribed support agent and a fraudulent remote hire, and bring the first metrics set to the board or its risk committee.
Common failure patterns
- Programme as surveillance: monitoring without clear purpose, limits or communication damages trust and may breach employment and privacy law.
- Ignoring non-human access: engineers who leave can still hold API keys, service account passwords and signing keys that no HR process tracks.
- Outsourcer blind spot: contractor and offshore support staff sit outside internal monitoring and access reviews.
- No case process: the first serious alert reveals that no one knows who decides, who preserves evidence or when to involve law enforcement.
- Hiring checks built for office workers: remote onboarding by email and couriered laptops are exactly what fraudulent hire schemes rely on.
Practitioner checklist
- Name an executive owner and a cross-functional insider risk working group.
- Document the lawful basis and limits for employee monitoring with legal.
- Identify high-impact roles and apply least privilege and record-level limits.
- Automate removal of human and non-human access on leaving.
- Add live identity verification and device controls to remote hiring.
- Put contractor and outsourced staff under named accounts and your own monitoring.
- Assign reviewers and response times to every insider-related alert type.
- Report insider risk metrics to the board or risk committee on a fixed cycle.
Standards and references
- CISA: Defining Insider Threats
- CISA: Insider Threat Mitigation Guide
- NPSA: NPSA changes insider risk definitions
- US Department of Justice: Coordinated nationwide actions to combat North Korean remote IT worker schemes
- ICO: Monitoring workers
- NIST: SP 800-53 Rev. 5 (PM-12 Insider Threat Program, PS-4 Personnel Termination)
How NHI Mgmt Group can help
We provide independent identity and non-human identity risk assessments and board briefings, with a focus on the privileged, support and machine access that insiders misuse and that leavers too often keep. Our NHI Foundation Level Training Course helps security and IAM teams govern service accounts, API keys and secrets. Contact NHI Mgmt Group to arrange a briefing.
Related NHI Mgmt Group resources: Insider Threat Programme Guide · Insider Threat and Identity Guide · Insider Data Theft Response Playbook · Top 10 Insider Threat Indicators