Insider Threat and Identity Guide

Insider threats start with legitimate access, which is why identity controls sit at the heart of preventing and detecting them. An insider might be a disgruntled employee copying data before leaving, a support agent bribed to look up customer records, a contractor using access they should have lost, or a fraudulent hire who was never who they claimed to be. Most insider incidents involve access that was granted properly and then misused, kept too long or never scoped in the first place. This guide explains the types of insider threat, the identity controls that limit what an insider can do, the credentials that must go when people move or leave, the signals that reveal misuse, and how to work with HR and legal without creating a surveillance culture. It covers AI agents, framework mapping, metrics and a roadmap, and is written for identity, security operations and insider risk teams.

Key takeaways

• Least privilege is the most effective insider control. An insider can only misuse access they have, so scope support, engineering and admin access to the task in hand.
• Segregation of duties stops one person acting alone. Dual approval for bulk exports, payments, releases and privilege grants forces collusion, which most insiders avoid.
• Leavers and movers are the high-risk moment. In the CERT repository, termination and resignation are the two most common stressors, and stale keys and publishing rights outlive the people who held them.
• Detect behaviour against a baseline. Unusual volume, timing, data types or destinations reveal misuse of valid access better than static rules.
• Run it as a programme, not a tool. HR, legal, privacy and security need shared governance, clear policies and monitoring that is proportionate and lawful.

Types of insider threat

CISA defines an insider as "any person who has or had authorized access to or knowledge of an organization's resources", and insider threat as the potential for that person to use their access or understanding to harm the organisation. The words "or had" matter: former staff and contributors remain insiders while any credential of theirs works. CISA separates unintentional threats (negligence and accidents) from intentional ones, and names two further groups: collusive threats, where insiders work with an external actor, and third-party threats from contractors and vendors.

The fraudulent hire is no longer rare. The FBI has warned that North Korean IT workers hired into remote roles have copied company code repositories to personal accounts, harvested credentials and session cookies, and extorted employers after being discovered. It says they have used "artificial intelligence and face-swapping technology during video job interviews" and recommends identity verification during interviewing, onboarding "and throughout the employment of any remote worker". See the Deepfake and AI Impersonation Guide.

Lessons from incidents

Three recent cases show access that was legitimate when granted, used beyond its purpose or its owner's tenure.

• Coinbase (2025): criminals bribed overseas support agents to copy customer data out of internal support tools, then demanded $20 million. According to Coinbase's notice to the Maine Attorney General, reported by The Register, 69,461 customers were affected and the theft began on 26 December 2024. Coinbase refused to pay and estimated costs at $180 million to $400 million. The lesson: support identities with wide read access are a recruitment target.
• Coupang (2025): a former developer used an authentication signing key he had obtained while employed, which was never revoked or rotated after he left, to forge access tokens. Coupang notified 33.7 million customer accounts. The lesson: key material is part of the leaver process, not just accounts.
• Mastra npm attack (2026): the npm account of a former contributor still held publishing rights across the project's scope. Researchers read the incident as an account takeover rather than insider action, but the stale right is what let the attacker republish well over 100 packages with a malicious dependency (counts range from 116 to more than 140 by source). The lesson: a departed insider's unused access is a gift to outsiders too.

The CERT Insider Threat Incident Repository of more than 3,000 cases points the same way. It lists termination (375 incidents) and resignation (245) as the two most common stressors, with internal position change third (55). The most common exfiltration methods it observed were email (141 incidents) and removable media (90).

Preventive identity controls

Prevention aims to make harmful acts impossible for one person, or at least loud. CERT's Common Sense Guide notes that people "can easily circumvent separation of duties if it is enforced by policy rather than by technical controls", so build these into systems rather than handbooks.

Scope what each identity can do

• Least privilege: give support and operations staff access only to the records needed for the case in front of them, not the whole customer base. Attribute or relationship-based rules (assigned ticket, region, customer tier) do this better than broad roles. See the Authorisation Models Guide.
• Just-in-time privilege: no standing admin rights; elevation is requested, approved, time-bound and logged. See the JIT Access Guide.
• Dedicated admin accounts: keep privileged work separate from email and browsing, as CIS Safeguard 5.4 requires, so admin activity is easy to isolate and review.
• Rate and volume limits: cap bulk export, search and record views in customer data tools, with step-up approval above the cap.

Require a second person

• Segregation of duties: separate request and approval, create and pay, develop and deploy, back up and restore. CERT describes the two-person rule as requiring "two people to participate in a task for it to be executed successfully". See the Segregation of Duties Guide.
• Release control: independent review before release, and package publishing only from CI.

Keep identities attributable and verified

• Named accounts only: shared accounts make attribution impossible. See the Password Security Guide.
• Owned non-human identities: every service account, key and token has a named owner who is not its only user. See the Secrets Management Guide.
• Access reviews focused on high-risk entitlements and privilege creep. See the Access Reviews Guide.
• Verified hiring: confirm identity at recruitment and onboarding, complete as much of it in person as practical, and require staffing firms to do the same.

Movers and leavers

CERT advises that when people change jobs, organisations should "disable their access to previously required information and information systems" unless they keep the old duties. Its termination checklist goes further for departing privileged users: change shared account passwords, service accounts, network devices, test accounts and jump boxes. NIST SP 800-53 PS-4 requires disabling system access within a defined period and revoking "any authenticators and credentials associated with the individual".

• Movers: remove old-role access when people move, not just add new access. See the Joiner-Mover-Leaver Guide.
• Leavers: revoke accounts, sessions, tokens, API keys, SSH keys, OAuth grants and package publishing rights, and transfer ownership of NHIs they owned. See the NHI Ownership Guide.
• Secrets they knew: rotate shared secrets, break-glass credentials and signing keys the person could reach. See the Cryptographic Key Management Guide and the Break-Glass Account Guide.
• Look back: CERT suggests reviewing at least 30 days of a leaver's activity before and after termination, and 90 days if the data is available, including email to personal accounts and cloud storage.
• High-risk leavers: where policy and law allow, apply closer monitoring during the notice period, or disable access on notice (SP 800-53 AC-2(13) covers disabling accounts for high-risk individuals).

Detection signals

CISA notes that malicious insider acts "are rarely spontaneous; instead, they are usually the result of a deliberate decision to act", and that detection "requires both human and technological elements". CERT advises baselining normal behaviour for networks and people over a window long enough to absorb normal peaks but short enough that malicious activity does not become the baseline.

User and entity behaviour analytics (UEBA), identity threat detection and data loss prevention tools help surface these signals; the value comes from correlating them with HR context such as a resignation or a performance process, which SP 800-53 AU-6(9) describes as correlation with information from non-technical sources. See the ITDR Guide, the Privileged Session Management Guide and the Data Loss Prevention (DLP) Guide.

Running an insider risk programme

CISA frames insider threat mitigation as four steps: Define, Detect and Identify, Assess, and Manage. NIST SP 800-53 PM-12 asks for an insider threat programme "that includes a cross-discipline insider threat incident handling team", and CERT's 22 best practices assign tasks across management, HR, legal, security, IT, data owners and engineers.

• Governance: bring together security, HR, legal, privacy and business leaders with a named senior owner and a written charter. See the Insider Threat Programme Guide.
• Critical assets first: CERT's first practice is to know and protect critical assets; decide which data and systems would cause most harm before choosing tools. See the Data Classification Guide.
• Transparent policy: publish acceptable use and monitoring policies so staff know what is monitored and why.
• Lawful, proportionate monitoring: the UK ICO says employers "must carry out a DPIA before undertaking any processing likely to cause high risk" to workers, should do one even where it is not required, and must inform workers about monitoring apart from "very exceptional circumstances" where covert monitoring is justified. See the Identity Data Privacy and Consent Guide.
• Fair investigations: protect evidence, limit who sees case data, and let HR and legal decide outcomes.
• Third parties included: extend the programme to contractors and outsourced staff through contracts, sponsor ownership and access expiry. See the Third-Party Access Guide.
• Positive measures: CERT's practice 21 recommends positive incentives; CISA notes that many malicious insiders want to "get even" over perceived lack of recognition or termination.

Insiders and AI agents

AI agents acting with an employee's authority create a new route for insider misuse and can amplify an honest mistake. The OWASP Top 10 for Agentic Applications 2026 says rogue agents (ASI10) "can be amplified 'insider threats' due to the speed and scale of Agentic systems". Its Identity and Privilege Abuse entry (ASI03) warns that without "a distinct, governed identity of its own, an agent operates in an attribution gap that makes enforcing true least privilege impossible".

• Own identities: give agents their own scoped identities rather than a copy of the user's session, and record which human each action was on behalf of. See the AI Agent Authorisation Guide.
• Same limits as people: apply the volume limits, dual approvals and data restrictions that apply to staff; an insider should not be able to route a bulk export through an assistant to avoid a cap.
• Delegation scoping: OWASP lists un-scoped privilege inheritance and memory-based privilege retention as common examples; strip permissions when one agent delegates to another and clear cached credentials between tasks and users.
• Agents in the leaver process: inventory agents and automations by creator, and transfer or retire them when that person leaves.
• Logging and response: log agent tool calls with the delegating user and feed them to the same analytics as human activity. See the AI Agent Observability and Incident Response Guide and the Identity Governance for AI Agents Guide.

Framework mapping

IDs were checked against the framework texts; CIS entries are v8.1 safeguards.

Common failure patterns

• Offboarding stops at the directory account. The SSO account is disabled but signing keys, API tokens and registry rights live on, as at Coupang and Mastra.
• Support tools see everything. Agents can search any customer, so one bribed agent can copy thousands of records, as at Coinbase.
• Movers accumulate access. New access is added on transfer and old access is never removed, so long-serving staff hold the widest rights.
• Segregation of duties exists only on paper. Policy says two people, but the system lets one person request and approve.
• Outsourced staff sit outside the programme. Contractor accounts are not tied to HR events, so leavers at the supplier keep access.
• Alerts without context. Analytics fire on volume but nobody links them to a resignation, so the case is closed as noise.
• Monitoring without a lawful basis. Intrusive tools are switched on without a DPIA or worker notice, creating legal risk and eroding trust.
• Agents borrow users' full rights. Assistants run with the employee's session, so caps and approvals that bind people do not bind the agent.

Metrics that show progress

Track exposure falling and detection improving. See the Identity Security Metrics Guide.

Implementation roadmap

Practitioner checklist

• Identify the data and systems where insider misuse would cause most harm.
• Scope access to them tightly, with just-in-time elevation and technically enforced SoD.
• Limit bulk export and search in support and data tools, with approval above the cap.
• Use named accounts only, and give every NHI a named owner.
• Automate removal of old-role and leaver access, including tokens, keys, OAuth grants and publishing rights.
• Review a leaver's activity for at least 30 days around departure.
• Baseline normal behaviour and alert on deviations in volume, time, destination and data type.
• Verify identity during hiring, onboarding and employment of remote workers.
• Give AI agents their own scoped identities and apply the same limits as people.
• Govern the programme with HR, legal and privacy, complete a DPIA, and tell staff what is monitored.
• Extend the programme to contractors and outsourced staff.

Standards and references

• NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
• NIST: The Cybersecurity Framework (CSF) 2.0
• CISA: Insider Threat Mitigation
• CISA: Defining Insider Threats
• CISA: Detecting and Identifying Insider Threats
• CERT: Common Sense Guide to Mitigating Insider Threats, Seventh Edition
• CIS: The 18 CIS Critical Security Controls
• OWASP: Non-Human Identities Top 10 2025
• OWASP: Top 10 for Agentic Applications for 2026
• ICO: Data protection and monitoring workers
• FBI IC3: Public service announcement on North Korean IT workers and data extortion

Related NHI Mgmt Group resources: Insider Threat Programme Guide · ITDR Guide · Segregation of Duties Guide · Joiner-Mover-Leaver Guide · Third-Party Access Guide