Security Insights · Insider risk · 9 min read
What Is an Insider Threat? Types, Warning Signs and Controls
What is an insider threat? CISA's definition, the malicious, negligent and compromised types, warning signs, and the NIST controls that limit the damage.
Firewalls, intrusion detection and email filtering are built to keep attackers out. Insider threats start on the other side of those defenses, with someone who already has an account, a badge or a contractor login. In government, law enforcement, legal, healthcare and defense work, that can be anyone able to open case files, patient records or controlled technical data.
This guide covers the definition, the main types, the warning signs and the controls that limit the damage.
What is an insider threat?
An insider threat is the risk that someone with authorized access, such as an employee or contractor, uses it to harm the organization, deliberately or by mistake. The Cybersecurity and Infrastructure Security Agency (CISA) defines it as the threat that an insider will use authorized access, "wittingly or unwittingly," to harm an organization's mission, people, facilities, information or systems.
CISA defines an insider as any person who has or had authorized access to, or knowledge of, an organization's resources, including its personnel, facilities, information, equipment, networks and systems. The words "has or had" matter: former employees still count, and so do contractors and vendors given access to do their work.
Types of insider threats
CISA groups insider threats by intent. Security teams also treat a third case as insider risk: an outsider using a real employee's credentials.
Malicious insiders
CISA describes intentional threats as actions taken to harm an organization for personal benefit or to act on a personal grievance. Examples include leaking sensitive information, stealing intellectual property and sabotaging equipment. CISA also describes collusive threats, where one or more insiders work with an outside threat actor.
Negligent or unintentional insiders
Negligent insiders know the security policies and ignore them, for example by letting someone follow them through a secure door or ignoring prompts to install security updates. Accidental insiders make honest mistakes, such as mistyping an email address and sending a sensitive document to the wrong person, or opening a phishing attachment.
Compromised credentials
When an attacker signs in with a valid username and password, the activity looks like an insider's. In advisory AA24-046A (February 2024), CISA described a state government organization breached through a former employee's administrator account that had not been disabled when the person left. In that incident, the credentials had likely been exposed in a separate data breach, and neither administrator account the attacker used had multifactor authentication enabled.
For a leadership view of why these three types are hard to spot, read Your Biggest Security Threat Already Has a Password.
Malicious vs negligent vs compromised insider
Each type calls for a different first control.
| Malicious insider | Negligent or unintentional insider | Compromised credentials | |
|---|---|---|---|
| Intent | Deliberate harm, for personal benefit or over a grievance | No intent to harm: a shortcut or a mistake | The account owner is not involved; an outside attacker controls the account |
| Example | An employee copies sensitive files to a personal account before resigning | A staff member emails a sensitive document to the wrong address | An attacker signs in with a former employee's account that was never disabled |
| Main control | Least privilege and separation of duties, backed by audit log review | Training, clear policies and need-to-know sharing by default | Multifactor authentication and prompt account removal at offboarding |
Warning signs of an insider threat
Warning signs are reasons to look closer, not proof. CISA notes that most people facing stressful events do not turn to harmful acts, and that filing a formal workplace grievance should not be read as a sign of an insider threat.
Behavioral signs
CISA's insider threat tip card lists behaviors such as working odd hours without authorization, copying material without a clear need and showing interest in matters outside one's duties. NIST notes that some insider crimes are preceded by nontechnical behaviors, such as ongoing patterns of disgruntlement and conflicts with coworkers.
Technical signs
- Access to files, cases or systems outside the person's role.
- Unusually large downloads, copies or print jobs.
- Remote sign-ins at odd hours, or from unfamiliar locations or devices.
- Attempts to gain extra privileges or turn off logging.
- Accounts still active after their owner has left.
Technical signs depend on logs. Without a record of who opened, downloaded or shared what, they stay invisible.
How to reduce insider threat risk
No single tool stops insider threats. NIST SP 800-53 Rev. 5, the US federal catalog of security and privacy controls, covers the core measures:
- Least privilege (AC-6): allow users, and processes acting for them, only the access needed for their assigned tasks.
- Need-to-know: the holder of official information decides whether a recipient needs that specific information to carry out their duties. A clearance or job title alone is not enough.
- Separation of duties (AC-5): split sensitive tasks so no one person can misuse a system alone. NIST's guidance includes making sure the people who administer access control do not also administer audit functions.
- Monitoring and audit logs (AU-2, AU-6, AU-12): decide which events to log, generate the records and review them regularly for inappropriate or unusual activity.
- Offboarding (PS-4, AC-2): when someone leaves, disable their access within a set time, revoke their credentials and recover equipment. Review access when people change roles, too (PS-5).
- Multifactor authentication: CISA recommends it, preferably phishing-resistant, for remote access and administrator accounts, so a stolen password is not enough on its own.
Do you need an insider threat program?
For some organizations, a program is mandatory. Executive Order 13587 (October 2011) and the National Insider Threat Policy and Minimum Standards (November 2012) require executive branch departments and agencies that handle classified information to run insider threat programs. Contractors cleared under the National Industrial Security Program have a matching duty under the NISPOM rule, 32 CFR 117.7(d).
For everyone else, a formal program is a choice, but the risk is not. NIST SP 800-53 includes an insider threat program control (PM-12) and notes that the standards used in classified settings can also improve protection of controlled unclassified and other information. CISA advises starting small and building on existing capabilities, which usually means getting least privilege, logging and offboarding right first.
Where DekkoCORE fits
DekkoCORE lets you apply least privilege to shared files: each person you share with gets the permission level you choose, such as View only, where files are read in the browser with no download or print button. Access ends on the expiry date you set. Every view and download is recorded in the audit log, giving reviewers the record that insider threat monitoring depends on.
Common questions
Frequently Asked Questions
What are the main types of insider threats?
The main types of insider threats are malicious insiders, who cause harm on purpose, and unintentional insiders, who cause harm through negligence or honest mistakes. Compromised credentials are often treated as a third type, because an attacker signed in with a valid account looks like an insider to the systems being used.
Is a former employee an insider threat?
A former employee can be an insider threat. CISA's definition of an insider covers anyone who has or had authorized access to, or knowledge of, an organization's resources. Accounts left active after someone leaves are a known risk, which is why NIST SP 800-53 calls for disabling access and revoking credentials when employment ends.
What is an example of an unintentional insider threat?
A common unintentional insider threat is an employee who mistypes an email address and sends a sensitive document to the wrong recipient. Other examples CISA gives include losing a portable storage device that holds sensitive information and opening a phishing attachment. No harm was intended, but the information is exposed all the same.
How is an insider threat different from an external threat?
An insider threat comes from someone who already has authorized access, while an external attacker has to get in first. Insider activity uses valid accounts and normal tools, so perimeter defenses such as firewalls are not designed to flag it. Detecting insider threats depends on access limits, audit logs and review of unusual activity.
Can insider threats be prevented?
Insider threats can be reduced but not eliminated, because organizations must trust people with access to do their work. Least privilege, separation of duties and need-to-know limit how much any one person can reach. Audit logs and prompt offboarding make misuse easier to detect and shorten the window for it.