Most cyber security attention focuses on external attackers. But some of the most damaging incidents involve current or former employees, contractors, and business partners — people who already have access to your systems and data. Insider threats are underreported, underdefended, and often more costly than external attacks.
The 2023 Verizon DBIR found that 19% of data breaches involved insider action. The actual number is likely higher — insider incidents are frequently not reported due to reputational concerns and the complexity of legal action against employees. For small businesses, a single insider incident — a disgruntled employee copying client data before leaving, a contractor accessing systems beyond their scope, or an employee manipulating financial records — can be existential.
Types of Insider Threat
Malicious insiders: Employees or contractors who intentionally misuse their access. Motivations include financial gain (selling data, manipulating financial systems), revenge after a workplace dispute, and espionage (copying client data before leaving to join a competitor).
Negligent insiders: Employees who create security risks through carelessness — clicking phishing links, using weak passwords, misconfiguring cloud services, or sharing credentials with colleagues. Negligent insiders account for a significant majority of insider-related incidents and are not malicious — they're simply not security-aware or careful enough.
Compromised insiders: Employees whose accounts have been taken over by external attackers. The attacker uses the legitimate employee's credentials and access to move laterally, exfiltrate data, or deploy malware — appearing as an insider in logs and audit trails.
The Access Control Fundamentals
Least privilege: Every staff member should have access only to the data and systems they need for their current role. An administrator shouldn't have access to HR files. A junior employee shouldn't have access to financial systems. Access reviews — periodically auditing who has access to what — are essential, particularly as people change roles.
Offboarding process: When staff leave, all access should be disabled on their last day — before they physically leave the building. This includes: user accounts disabled, email forwarding removed, admin privileges revoked, physical access revoked (building codes, key returns), and personal device remote wipe initiated. A former employee with active system access is an ongoing risk regardless of how amicable the separation was.
Audit logging: Maintain logs of who accesses what data, particularly for sensitive information. If a data breach or theft occurs, audit logs are often the only way to determine what was accessed, by whom, and when. Microsoft 365's unified audit log is available in the Purview compliance portal and should be retained for a minimum of 90 days (one year for Business Premium tenants).
Most insider incidents happen to organisations without formal offboarding processes and without access reviews. Neither requires sophisticated technology — they require organisational discipline around who has access to what, and a reliable process to remove that access when it's no longer needed.
