An insider threat is a risk that originates from someone with authorised access to systems or data, such as an employee, contractor or partner. It covers malicious acts, like stealing data before leaving, and unintentional ones, like emailing a file to the wrong person or falling for phishing.
Why it matters
Insiders already pass the perimeter and know where valuable information sits, so ordinary defences are less effective. Most incidents involve mistakes or compromised accounts, not malice. Controls focus on limiting access to what a role needs, logging and reviewing sensitive actions, and promptly removing access when people change roles or leave.
Example
A company reviews its offboarding process after finding a former contractor's account was still active a month after their contract ended. It now ties account removal to the HR exit checklist, performs quarterly access reviews, and alerts on large downloads of customer records.
Common mistakes
- Assuming insider risk means only disgruntled staff.
- Giving broad access by default and never reviewing it.
- Monitoring in ways that ignore privacy law or erode trust; rules vary by country.
- Having no process for departing employees.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.