This is the Trace Id: b6f2fc0b6252d2bc9f66aaacacb79d9b
Skip to main content
Microsoft Security
Get the report
A person sitting down with their hand on a laptop.

What is an insider threat?

Explore how Microsoft Purview Insider Risk Management can defend your organization from insider activity, including users with authorized access who can willfully or unintentionally cause a data security incident.
Learn more

Insider threat defined

Before insiders become a threat, they are a risk, which is defined as the potential for a person to use authorized access to the organization’s assets—either maliciously or unintentionally—in a way that negatively affects the organization. Access includes both physical and virtual access, and assets include information, processes, systems, and facilities.

What is an insider?

An insider is a trusted individual who has been given access to, or has knowledge of, any company resources, data, or system that’s not generally available to the public, including:

  • People who have a badge or other device that allows them to continuously access the company’s physical property, such as a data center or corporate headquarters.
  • People who have a company computer with network access.
  • People who have access to a company’s corporate network, cloud resources, applications, or data.
  • People who have knowledge about a company’s strategy and knowledge of their financials.
  • People who build the company’s products or services.

More about insider threats

Insider risks are trickier to detect than external threats because insiders already have access to an organization’s assets and are familiar with its security measures. Knowing the types of insider risks helps organizations better protect valuable assets.

Accident

Sometimes people make mistakes that may lead to potential security incidents. For example, a business partner sends a document with customer data to a colleague, not realizing they aren’t authorized to view that information. Or an employee responds to a phishing campaign and inadvertently installs malware.

Malicious

In a malicious security incident caused by an insider, an employee or a trusted person intentionally does something that they know will negatively affect the company. Such individuals may be motivated by personal grievances or other personal reasons and may be seeking financial or personal gain through their actions.

Negligence

Negligence is similar to an accident in that the person didn’t intend to cause a data security incident. The difference is that they may knowingly break a security policy. A common example is when an employee allows someone to enter a building without showing a badge. A digital equivalent would be overriding a security policy without careful consideration for the sake of speed and convenience or signing into company resources over an unsecured wireless connection.

Collusion

Some insider security incidents are the result of a trusted person collaborating with a cybercriminal organization to commit espionage or theft. This is another type of malicious insider risk.
Back to tabs

Examples of insider threats

Insider threat incidents such as data theft, espionage, or sabotage have happened in organizations of all sizes over the years. A few examples are:

  • Stealing trade secrets and selling them to another company.
  • Hacking into a company’s cloud infrastructure and deleting thousands of customer accounts.
  • Using trade secrets to start a new company.

Importance of holistic insider risk management

A holistic insider risk management program that prioritizes employee-employer relationships and integrates privacy controls may reduce the number of potential insider security incidents and lead to faster detection. A recent study conducted by Microsoft found that companies with a holistic insider risk management program were 33 percent more likely to have fast detection of insider risk, and 16 percent more likely to have fast remediation than companies with a more fragmented approach.1

How to protect against insider threats

Organizations can address insider risk in a holistic way by focusing on processes, people, tools, and education. Use the following best practices to develop an insider risk management program that builds trust with employees and helps strengthen your security:

Prioritize employee trust and privacy

Building trust among employees begins with prioritizing their privacy. To foster a sense of comfort with their insider risk management program, consider implementing a multilevel approval process for initiating insider investigations. Additionally, it’s important to audit the activities of those conducting investigations to ensure they don’t overstep their boundaries. Implementing role-based access controls to limit who within the security team can access investigation data can also help maintain privacy. Anonymizing usernames during investigations can further protect employees’ privacy. Finally, consider deleting user flags after a set period of time if an investigation doesn’t proceed.

Use positive deterrents

While many insider risk programs rely on negative deterrents, such as policies and tools that restrict risky employee activities, it’s crucial to balance these measures with a preemptive approach. Positive deterrents, such as employee morale events, thorough onboarding, ongoing data security training and education, upward feedback, and work-life balance programs can help mitigate the likelihood of insider events. By engaging with employees in a productive and proactive way, positive deterrents address the source of risk and promote a culture of security within the organization.

Attain company-wide buy-in

IT and security teams may bear the primary responsibility for managing insider risk, but it’s essential to engage the entire company in this effort. Departments such as human resources, compliance, and legal play a critical role in defining policies, communicating with stakeholders, and making decisions during an investigation. To develop a more comprehensive and effective insider risk management program, organizations should seek buy-in and involvement from all areas of the company.

Use integrated and comprehensive security solutions

Effectively protecting your organization from insider risks requires more than just implementing the best security tools; it demands integrated solutions that provide enterprise-wide visibility and protection. When data security, identity and access management, extended detection and response (XDR), and security information and event management (SIEM) solutions are integrated, security teams can efficiently detect and prevent insider incidents.

Implement effective training

Employees play a crucial role in preventing security incidents, making them the first line of defense. Securing your company’s assets requires gaining employee buy-in, which in turn enhances the organization’s overall security. One of the most effective methods for creating this buy-in is through employee education. By educating employees, you can reduce the number of inadvertent insider events. It’s important to explain how insider events can impact both the company and its employees. Additionally, it’s crucial to communicate data protection policies and teach employees how to avoid potentially leaking data.

Use machine learning and AI

Security risks in today’s modern workplace are dynamic with various, constantly changing factors that can make them difficult to detect and respond to. However, by using machine learning and AI, organizations can detect and mitigate insider risks at machine speed, enabling adaptive and people-centric security. This advanced technology helps organizations understand how users interact with data, calculate and assign risk levels, and automatically tailor appropriate security controls. With these tools, organizations can streamline the process of identifying potential risks and prioritize their limited resources on addressing high-risk insider activities. This saves security teams valuable time while ensuring better data security.

Insider risk management solutions

Defending against insider threats can be challenging, as it's natural to trust those who work for and with the organization. Quickly identifying the most critical insider risks and prioritizing resources to investigate and mitigate them is crucial to reducing the impact of potential incidents and breaches. Fortunately, many cybersecurity tools that prevent external threats can also identify insider threats.

Microsoft Purview offers information protection, insider risk management, and data loss prevention (DLP) capabilities to help you gain visibility into data, detect critical insider risks that may lead to potential data security incidents, and prevent data loss effectively.

Microsoft Entra ID helps you manage who can access what and can alert you if someone’s sign-in and access activity is risky.

Microsoft Defender 365 is an XDR solution that helps you secure your clouds, apps, endpoints, and email from unauthorized activities. Governmental organizations like the Cybersecurity and Infrastructure Security Agency also provide guidance for developing an insider threat management program.

By adopting these tools and using expert guidance, organizations can better manage insider risks and protect their critical assets.
Resources

Learn more about Microsoft Security

  1.
A woman looking at her mobile phone.

Microsoft Purview

Get governance, protection, and compliance solutions for your organization’s data.
Learn more
A group of people sitting around a round table with laptops.

Microsoft Purview Insider Risk Management

Detect and mitigate insider risks with ready-to-use machine learning models.
Learn more
A person holding a phone and using a laptop while sitting on a bench.

Adaptive Protection in Microsoft Purview

Secure data with an intelligent and people-centric approach.
Learn more
A woman is looking at the laptop.

Building a holistic insider risk management program

Learn about five elements that help companies have stronger data security while protecting user trust.
View the report
A man in a suit giving a presentation.

Microsoft Purview Data Loss Prevention

Prevent unauthorized sharing, transferring, or use of data across apps, devices, and on-premises environments.
Learn more
A person sitting at a desk using a computer.

Microsoft Purview Communications Compliance

Meet regulatory compliance obligations and address potential business conduct violations.
Learn more
A woman is looking at the laptop.

Microsoft threat protection

Protect devices, apps, emails, identities, data, and cloud workloads with unified threat protection.
Learn more
A man holding a phone and looking at it.

Microsoft Entra ID

Protect access to resources and data using strong authentication and risk-based adaptive access policies.
Learn more
Back to Resources section
FAQ

Frequently asked questions

  • There are four types of insider threats. An accidental insider threat is the risk that someone who works for or with a company makes a mistake that potentially compromises the organization or its data or people. A negligent insider risk is when someone knowingly breaks a security policy but doesn’t mean to cause harm. A malicious threat is when someone intentionally steals data, sabotages the organization, or behaves violently. Another form of a malicious threat is collusion, which is when an insider collaborates with someone outside the organization to cause harm.
  • Insider risk management is important because these types of incidents can do a great deal of damage to an organization and its people. With the right policies and solutions in place, organizations can get ahead of potential insider threats and protect the organization’s valuable assets.
  • There are several possible signs of an insider risk, including sudden changes in user activities, a connected sequence of risky activities, trying to access resources not needed for their job, attempting to escalate privileges, anomalous data exfiltration, departing employees exfiltrating data, and intimidation or harassment.
  • Preventing insider events can be tricky because risky activities that may lead to security incidents are performed by trusted people who have relationships at the organization and authorized access. A holistic insider risk management program that prioritizes employee-employer relationships and integrates privacy controls may reduce the number of insider security incidents and lead to faster detection. In addition to privacy controls and a focus on worker morale, regular training, company-wide buy-in, and integrated security tools can help reduce your risk.
  • A malicious insider threat is the possibility that a trusted person will deliberately harm the organization and the people who work there. This is distinct from unintentional insider risks that occur when someone accidentally compromises the company or breaks a security rule but doesn’t mean the company any harm.
  1. [1]
    “How can being holistic help an organization? The benefits of a holistic insider risk management program,” in Building a Holistic Insider Risk Management Program: 5 elements that help companies have stronger data protection and security while protecting user trust, Microsoft Security 2022, p. 41.

Follow Microsoft Security