The Three Kinds of Insider Risk

"Insider threat" covers three quite different situations. They share a characteristic — the activity comes from a legitimate account with legitimate access — and almost nothing else.

The negligent insider

Someone doing their job who makes a mistake or takes a shortcut.

Emailing a spreadsheet to a personal account to work on it at home. Uploading a document to a personal cloud drive because the corporate one is slow. Sending an attachment to the wrong recipient with a similar name. Leaving a laptop on a train.

This is the overwhelming majority of incidents by volume, and it is where the return on effort is highest, because the behaviour responds to intervention. A warning at the moment of the action changes it. Better tooling removes the reason for the shortcut.

Detection is straightforward — the activity is not concealed, because the person does not think they are doing anything wrong.

The correct response is rarely punitive. A negligence programme that generates disciplinary cases teaches people to hide mistakes, which removes your visibility of the category you were best placed to reduce.

The compromised insider

An account under external control. Credential theft, a successful phish, session hijacking.

The user is a victim, not an actor. But from the perspective of a monitoring system this looks like an insider, because it is a legitimate account doing legitimate-seeming things.

Detection relies on behavioural deviation — access from a new location, at an unusual hour, to systems this person never touches, at a volume they never move.

Response is incident response, not HR. The distinction matters enormously and gets confused surprisingly often: an early-stage investigation that treats a compromised employee as a suspect wastes time and does real damage to the person.

A useful rule: before treating anomalous behaviour as malicious, rule out compromise. It is the more common explanation and the faster one to check.

The malicious insider

Someone deliberately taking data or causing harm. Rare in absolute terms and disproportionately costly.

Sub-types worth distinguishing:

The departing employee taking work they consider theirs — customer lists, code, designs, proposals. By far the most common malicious case, frequently not perceived as theft by the person doing it.

The disgruntled employee, acting after a specific grievance: a passed-over promotion, a disciplinary process, a redundancy notice.

The recruited insider, acting for a competitor or a foreign interest. Rare, expensive, and the one that justifies programmes at organisations with genuinely valuable IP.

Detection is hardest here because the person knows the controls and has legitimate access. Behaviour frequently changes before the act — access patterns broadening, unusual interest in systems outside their role, activity outside normal hours.

Why conflating them fails

A programme tuned for malicious insiders generates alerts on thousands of negligent ones and drowns.

A programme tuned for negligence misses the deliberate actor entirely, because deliberate actors do not trip volume thresholds.

A programme that treats every anomaly as potential malice damages relationships with employees and, over time, with HR and legal, who stop taking referrals seriously.

The practical approach is separate handling. Negligence gets automated warnings and education, with human review only at repeated or high-severity events. Compromise gets routed to security operations as an incident. Malicious indicators get a defined, restricted investigation process with legal involvement from the start.

Same telemetry, three pipelines, three response paths. Building one pipeline for all three is the commonest design error in this field.