Insider threats start with legitimate access, which is why identity controls sit at the heart of preventing and detecting them. An insider might be a disgruntled employee copying data before leaving, a support agent bribed to look up customer records, a contractor using access they should have lost, or a fraudulent hire who was never who they claimed to be. Most insider incidents involve access that was granted properly and then misused, kept too long or never scoped in the first place. This guide explains the types of insider threat, the identity controls that limit what an insider can do, the signals that reveal misuse, and how to work with HR and legal without creating a surveillance culture.
Key takeaways
- Least privilege is the most effective insider control. An insider can only misuse access they have.
- Segregation of duties and dual approval stop a single person completing a harmful action alone.
- Leavers and movers are a high-risk moment: data theft often happens in the weeks before departure, and stale access lingers after it.
- Detection works best on behaviour against a baseline, such as unusual volume, timing or data types, rather than on static rules.
- Insider programmes need HR, legal and privacy involvement and clear, proportionate policies.
Types of insider threat
| Type | Example | Identity angle |
|---|---|---|
| Malicious insider | An employee steals data or sabotages systems | Excessive or standing access; weak monitoring |
| Recruited or bribed insider | Support staff paid to look up or export records | Broad access to customer data in support tools |
| Negligent insider | Credentials shared, data sent to personal accounts | Shared accounts; weak data controls |
| Compromised insider | An attacker uses an employee's stolen credentials | Authentication and session protection |
| Fraudulent hire | A person hired under a false or borrowed identity | Identity verification at hiring and onboarding |
| Departed insider | A leaver whose accounts, tokens or keys still work | Offboarding of human and non-human credentials |
Lessons from incidents
- Coinbase (2025): criminals bribed outsourced support agents to copy data on tens of thousands of customers, then attempted extortion.
- Coupang (2025): a former developer used a signing key that was never revoked to forge access.
- Mastra npm attack (2026): a former contributor's publishing rights were never removed and were used to backdoor packages.
Preventive identity controls
- Least privilege: give support and operations staff access only to the records needed for the case in front of them, not the whole customer base. See the Authorisation Models Guide.
- Just-in-time privilege: no standing admin rights. See the JIT Access Guide.
- Segregation of duties: separate request and approval, create and pay, develop and deploy. See the Segregation of Duties Guide.
- Named accounts only: shared accounts make attribution impossible. See the Password Security Guide.
- Rate and volume limits on bulk export and search in customer data tools.
- Access reviews focused on high-risk entitlements. See the Access Reviews Guide.
- Verified hiring: confirm identity at recruitment and onboarding. See the Deepfake and AI Impersonation Guide.
Movers and leavers
- Remove old-role access when people move, not just add new access. See the Joiner-Mover-Leaver Guide.
- On departure, revoke accounts, sessions, tokens, API keys, SSH keys, OAuth grants and package publishing rights, and transfer ownership of NHIs they owned. See the NHI Ownership Guide.
- Rotate shared secrets and keys the person knew. See the Cryptographic Key Management Guide.
- For high-risk leavers, and where policy and law allow, apply closer monitoring during the notice period.
Detection signals
- Access to data or systems outside the person's normal role or team.
- Unusual volume of downloads, exports, searches or record views.
- Activity at unusual times or from unusual locations or devices.
- Data moving to personal email, cloud storage or removable media.
- Privilege changes the person made to themselves or colleagues.
- Use of service accounts or other people's accounts.
- Activity from accounts that should be disabled.
User and entity behaviour analytics (UEBA), identity threat detection and data loss prevention tools help surface these signals. See the ITDR Guide and the Privileged Session Management Guide.
Running an insider risk programme
- Bring together security, HR, legal, privacy and business leaders, with clear governance.
- Publish acceptable use and monitoring policies so staff know what is monitored and why.
- Keep monitoring proportionate and lawful; complete data protection impact assessments where required. See the Identity Data Privacy and Consent Guide.
- Define an investigation process that protects evidence and treats people fairly.
- Extend the programme to contractors and outsourced staff. See the Third-Party Access Guide.
Insiders and AI agents
AI agents acting with an employee's authority can become a new route for insider misuse, or amplify a mistake. Give agents their own scoped identities, log what they do on whose behalf, and apply the same volume limits and approvals to agent actions as to people. See the AI Agent Observability and Incident Response Guide.
Practitioner checklist
- Identify the data and systems where insider misuse would cause most harm.
- Scope access to them tightly, with just-in-time elevation and SoD.
- Limit bulk export and search in support and data tools.
- Automate removal of old-role and leaver access, including NHI credentials and publishing rights.
- Baseline normal behaviour and alert on deviations in volume, time and data type.
- Verify identity during hiring and onboarding.
- Govern the programme with HR, legal and privacy, and extend it to third parties.
Standards and references
- CISA: Insider Threat Mitigation Guide
- CERT: Common Sense Guide to Mitigating Insider Threats, Seventh Edition (2022)
- NIST SP 800-53 Rev. 5 (PM-12 Insider Threat Program, AC-5 Separation of Duties, AC-6 Least Privilege)
Related NHI Mgmt Group resources: ITDR Guide · Segregation of Duties Guide · Joiner-Mover-Leaver Guide · Third-Party Access Guide
