Insider Threat Statistics Guide: Frequency, Costs and Detection

Insider threat numbers are hard to compare because the two main sources measure opposite things: one counts the cost of insider incidents inside organisations that already had them, the other counts which actors caused confirmed breaches across a whole caseload. This page collects the current insider threat statistics from the publishers' own pages: the Ponemon Institute 2026 Cost of Insider Risks: Global study (sponsored by DTEX), the Verizon 2026 Data Breach Investigations Report (DBIR), the UK government Cyber Security Breaches Survey 2025/2026, and the US Department of Justice actions on North Korean remote IT workers. Every figure carries the report name, publisher and edition in the same sentence or table row, and anything we could not trace to the publisher is left out. It is written for insider risk leads, security operations teams and risk managers who need defensible numbers for a business case, a risk register or a board paper. Last reviewed: October 2026.

Key takeaways

• The annual cost keeps rising. The Ponemon 2026 Cost of Insider Risks: Global study puts the average annual cost of insider risk at $19.5 million in 2025, up from $17.4 million in 2024, across 354 organisations that had at least one material insider event.
• Negligence, not malice, drives most of the bill. In the same Ponemon 2026 study, negligent insiders account for 53% of incidents and $10.3 million a year on average, against 27% for malicious insiders and 20% for credential theft.
• Stolen credentials are the most expensive insider incident. Ponemon 2026 prices a credential theft incident at $842,462 on average, up from $779,707, which makes identity controls an insider control.
• Speed of containment changes the cost. Ponemon 2026 reports an average of 67 days to contain an incident (81 days a year earlier); organisations containing in under 30 days averaged $14.2 million a year against $21.9 million for those taking more than 90 days.
• Breach caseloads show a smaller insider share outside a few sectors. The Verizon 2026 DBIR attributes 44% of Public Administration breaches and 22% of Education breaches to internal actors, but only 1% in EMEA and Northern America overall, and Privilege Misuse fell to 3% of all breaches.

Headline statistics

Statistics by theme

Frequency and incident mix

• Incident mix: the Ponemon 2026 Cost of Insider Risks: Global study splits incidents into negligent or mistaken insiders (53%), malicious or criminal insiders (27%) and outsiders using stolen insider credentials (20%). Ponemon defines an insider incident broadly, including attacks where an external actor steals a legitimate user's credentials, so the 20% overlaps with what other reports call external credential abuse.
• Incidents per organisation: in the same study the average organisation had 13.8 negligent incidents, 6.3 malicious incidents and 5.3 credential theft incidents a year (credential theft was 4.8 a year earlier). DTEX's release on the report gives an average of about 25 incidents per organisation.
• High-volume organisations: Ponemon 2026 finds 68% of organisations had between 21 and more than 40 incidents in the year, up from 57% in the previous study.
• Sample growth: Ponemon reports the benchmark grew from 156 organisations in its 2018 study to 354, and analysed incidents from 3,269 to 7,490. The growth is in the sample, not necessarily in insider activity.

Costs

Ponemon 2026 also breaks costs into financial consequences: technology accounts for 30% and business disruption (lost productivity) for 19% of the average. The DTEX release states the annual cost has risen 20% over two years.

Detection and containment

• Time to contain: Ponemon 2026 records 67 days on average in 2025, down from 81 days in 2024; the DTEX release describes this as a record low and compares it with 86 days in 2023.
• Containment speed and cost: organisations containing incidents in under 30 days averaged $14.2 million a year; those taking more than 90 days averaged $21.9 million (Ponemon 2026). Only 13% of incidents were contained in under 30 days.
• Control savings: Ponemon 2026 associates privileged access management with average savings of $6.1 million and user behaviour analytics with $5.1 million. The DTEX release words these as identity management and behavioural intelligence. These are associations in a survey sample, not controlled measurements.
• UK control adoption: the Cyber Security Breaches Survey 2025/2026 (DSIT) finds 30% of UK businesses and 31% of charities use user monitoring, 73% of businesses restrict admin rights, 47% of businesses use two-factor authentication, and 19% of businesses ran staff training or awareness activity in the year (84% of large businesses). It also reports 64% of micro businesses allow access only through company-owned devices, up from 58%.

Insider share of breaches

The Verizon 2026 DBIR executive summary covers more than 31,000 incidents and more than 22,000 confirmed breaches in 145 countries. It does not give a single global internal-actor figure in the summary; it gives regional and industry splits.

• Privilege Misuse pattern: 3% of breaches in the 2026 DBIR, down from 7% and 8% in the two previous editions.
• Miscellaneous Errors pattern: 8% of breaches, down from 12% and 25%. This is where misdelivery and misconfiguration by staff sit.
• Human element: 62% of breaches involve a human action such as error, misuse or social engineering, up from 60%. Most of this is external manipulation of staff, not insider intent.

Generative AI and agents as insider channels

• Unsanctioned AI accounts: the Verizon 2026 DBIR reports that 45% of employees are regular AI users on corporate devices (15% the year before) and that 67% of users reach AI services through non-corporate accounts on corporate devices.
• Exfiltration concern: according to the DTEX release on the 2026 Cost of Insider Risks report, 73% of respondents worry unauthorised AI use creates hidden data exfiltration paths, while only 18% have fully integrated AI governance into their insider risk programmes.
• Agents: the same release reports 44% expect malicious use of AI agents to increase data theft risk, nearly half have minimal or no visibility into agent activity, and 19% classify AI agents as equivalent to human insiders. See the Insider Risk from AI Tools Guide.

Programmes and budgets

• Programme adoption: the DTEX release states 63% of organisations in the Ponemon sample run a dedicated insider risk programme, that these programmes prevented an average of seven incidents and avoided $8.2 million, and that 49% rate their programme very or highly effective.
• Budget share: insider risk spending rose from 8.2% of IT security budgets in 2023 to about 19% in 2025; 64% increased insider risk budgets in 2025, 45% still call funding insufficient and 70% expect a further rise in 2026 (DTEX release, February 2026).

Fraudulent remote workers

The US Department of Justice announced on 30 June 2025 coordinated actions against North Korean remote IT worker schemes, including searches of 29 suspected laptop farms across 16 states and the seizure of around 200 computers, with schemes alleged to have affected more than 100 US companies. In one case the DOJ alleges more than 80 US identities were used and victim companies suffered at least $3 million in damages. These are allegations from court documents. See the Insider Threat from Fake IT Workers Guide.

What the numbers mean for defenders

Read together, the figures say that most insider cost comes from ordinary access used carelessly or stolen, and that the cost falls when organisations see and contain activity quickly. That points to identity and monitoring controls before investigations tooling.

• Treat credential theft as an insider scenario: the most expensive Ponemon category is an outsider using a valid account. Phishing-resistant MFA, session controls and fast revocation reduce it. See the Insider Threat and Identity Guide.
• Close leaver gaps, including keys and tokens: the Coupang breach involved a former engineer whose token signing key was never revoked or rotated after he left. Offboarding must cover secrets and machine credentials, not only the HR account. See the Employee Offboarding Security Guide and the NHI Offboarding and Decommissioning Guide.
• Watch outsourced and support roles: the Coinbase insider breach involved bribed overseas support staff using the access they had for their jobs, with an estimated $180 million to $400 million in costs per its SEC filing. Least privilege on support tooling and query-volume alerting matter more than perimeter controls here.
• Invest in containment speed: the $7.7 million gap between under-30-day and over-90-day containment in Ponemon 2026 is the clearest business case figure. Pre-agreed HR, legal and security escalation paths shorten it. See the Insider Threat Response Playbook.
• Size by sector: a public sector body should not plan on the 1% EMEA internal share in the DBIR when its own sector shows 44%.

Choosing which figure to use

Small organisations should take the Ponemon fewer-than-500-employee figure ($8.9 million) with caution: the sample only includes organisations that already had material insider events. For them the DSIT control adoption rates are a more realistic benchmark.

Rolling the numbers into a programme

1. Pick your sector row from the DBIR and the size and industry rows from Ponemon, and record both in the risk register with their edition.
2. Baseline your own measures for the same quantities: incidents by type, days to contain, leaver accounts closed on time.
3. Pilot user and entity behaviour analytics or DLP in monitor-only mode on one high-risk group (support, finance, departing staff) and tune before alerting. See the UEBA Guide and the Data Loss Prevention (DLP) Guide.
4. Agree the escalation path with HR and legal, then measure containment time against the Ponemon 67-day average.
5. Review quarterly; if a control produces volume without findings, roll it back to monitor-only and retune rather than drop it.

Metrics that show progress

• Median days from first insider alert to containment, against Ponemon's 67-day average.
• Share of leaver accounts, tokens and keys revoked within 24 hours of departure.
• Number of standing privileged accounts per 100 staff.
• Share of high-risk users covered by behaviour monitoring.
• Insider incidents by type (negligent, malicious, credential) compared with the Ponemon 53/27/20 split.
• Share of AI tool use through sanctioned corporate accounts, against the DBIR 67% non-corporate figure.

Framework mapping

In CIS Controls v8.1 the same findings map mainly to Control 5 (Account Management), Control 6 (Access Control Management) and Control 14 (Security Awareness and Skills Training).

Common failure patterns when using insider statistics

• Quoting the Ponemon average as a likelihood: $19.5 million is the average for organisations that already had material insider events, not an expected cost for every organisation.
• Adding Ponemon and DBIR shares together: Ponemon counts credential theft by outsiders as insider risk; the DBIR counts the same event as an external actor. Combining them double counts.
• Reading the falling Privilege Misuse share as falling risk: a pattern's share moves when other patterns grow, so a smaller share can hide a stable or rising count.
• Treating vendor-sponsored control savings as proof: the PAM and UBA savings are correlations in a sponsored survey; present them as such.
• Ignoring machine credentials: offboarding statistics usually count human accounts only, yet keys left with former staff, as in the Coupang case, act as insider access.
• Using last year's edition without saying so: always print the edition and data year next to the figure.

Methodology notes and caveats

• Ponemon 2026 Cost of Insider Risks: Global: the seventh benchmark, sponsored by DTEX and conducted by Ponemon Institute. It interviewed 8,750 IT and IT security practitioners in 354 organisations in North America, EMEA and Asia-Pacific that had one or more material insider-caused events, with headcounts from under 500 to more than 75,000. DTEX states data collection ran for two months ending in September 2025, so the figures describe 2025. Costs are self-reported activity-based estimates.
• Verizon 2026 DBIR: a caseload of incidents contributed by partners and Verizon's own investigations, not a random sample. Internal-actor shares depend on which contributors see which sectors. Public sector reporting obligations can raise its internal share.
• DSIT Cyber Security Breaches Survey 2025/2026: official statistics from a random-probability telephone and online survey of UK businesses and charities; it measures control adoption, not insider incidents, and some sections are perception based.
• DOJ figures: taken from charging documents and announcements; they are allegations until proven in court, and the release's summary and detail sections count the searches differently (29 laptop farms in 16 states in the summary, 21 premises in 14 states in one detail section).
• What is missing: there is no recurring official statistic on insider incidents across the economy in the UK or US. CISA publishes guidance and the Insider Risk Mitigation Program Evaluation tool rather than statistics.

Practitioner checklist

• Cite every insider figure with publisher, report name and edition, and say whether it is a cost benchmark or a breach share.
• Use your own sector row from the Verizon 2026 DBIR rather than the global narrative.
• Measure your days to contain insider incidents and compare with the Ponemon 67-day average.
• Include credential theft scenarios in insider risk assessments and fund phishing-resistant MFA from the same budget line.
• Extend leaver processes to API keys, signing keys, tokens and service accounts owned by the departing person.
• Apply least privilege and query-volume alerting to support and outsourced staff with access to customer data.
• Add identity proofing and device checks to remote hiring to address fraudulent IT worker schemes.
• Bring AI tools and agents into the insider risk programme scope, including non-corporate account use.
• Assess programme maturity with the CISA Insider Risk Mitigation Program Evaluation and repeat it annually.
• Review this page's sources each spring when the new Ponemon and DBIR editions are published.

Standards and references

• CISA: Insider Threat Mitigation
• NIST: SP 800-53 Rev. 5
• Ponemon Institute: 2026 Cost of Insider Risks: Global
• DTEX: Insider Risk Costs Hit $19.5M USD Per Year as AI Creates New Blind Spots
• Verizon: 2026 Data Breach Investigations Report Executive Summary
• DSIT: Cyber Security Breaches Survey 2025/2026
• US Department of Justice: Coordinated Nationwide Actions to Combat North Korean Remote Information Technology Workers

Related NHI Mgmt Group resources: Insider Threat Programme Guide · Insider Data Theft Guide · Data Breach Statistics Guide · Identity Attack Statistics Guide · Cyber Insurance Statistics Guide