Insider Threat: The Type Most Programs Aren't Watching For
Most insider threat programs center on one person: The employee who decides to steal data or sell access. That person is real, and planning for them makes sense. The insider incidents that land on a security team’s desk usually look different, though.
A finance manager wires a payment because an email from the “CFO” says the acquisition falls apart if the money isn’t there by Friday. Elsewhere in the company, someone on the help desk resets multifactor authentication (MFA) for a caller who sounds just like a frustrated executive stuck at an airport. Neither of them meant to cause harm, and the controls built to catch bad intent had nothing to say about either one.
This is the compromised insider: A well-meaning employee with an attacker steering, or an attacker logged in with an employee’s credentials. The access looks routine, so nothing flags it. What’s off is the request.
It’s also a bigger share of insider risk than most programs plan for. The 2026 Cost of Insider Risks Global Report from Ponemon Institute, sponsored by DTEX, puts the average annual cost of insider risk at $19.5 million per organization.
More than half of that, $10.3 million, comes from negligent or mistaken insiders, not malicious ones. Seeing and reducing that risk doesn’t require treating coworkers like suspects.
Three kinds of insider threats
Insider risk can come from anyone with legitimate access, including employees, contractors, vendors, and partners. Insider threats tend to fall into three types, and each calls for a different response.
Malicious insiders act against the organization on purpose. Some act out of grievance or for money. Others join after an outside group recruits them.
In 2025, the Medusa ransomware gang offered a BBC correspondent 15% of a future ransom, later raising the offer to 25%, in exchange for access to internal systems. This is the group most insider threat tooling exists to find.
NINJIO’s episode “Beware of the Insider” follows an employee who notices a coworker’s actions putting company data at risk and has to decide whether to take it to HR.
Negligent insiders make mistakes without meaning any harm. They send a file to the wrong external address, reuse a password, or skip a step because the deadline was tight. By cost, this is the largest category in the Ponemon data.
Compromised insiders follow an attacker’s lead without knowing it, or they aren’t acting at all because someone else is using their account. Ponemon’s 2025 edition called them “outsmarted” insiders and found they were behind about one in five insider incidents.
The line between negligent and compromised is thin. A rushed mistake becomes a compromised insider incident the moment someone outside the company creates the rush.
The compromised insider threat most programs miss
Programs built to catch malicious insiders look for signs of intent, like large downloads before a resignation or files moving to personal accounts. Those signals are worth watching. They stay quiet when a trusted employee does their normal job on someone else’s behalf.
These insider threat examples show what a compromised insider looks like in practice:
- An accounts payable specialist updates a vendor’s bank details after a polished email from the vendor’s “new controller.”
- An IT admin approves an MFA prompt they didn’t start, because the requests kept coming during a meeting, and they wanted them to stop.
- A sales rep shares a project folder with a “partner” they’ve chatted with on LinkedIn for three weeks.
- An attacker uses a session token lifted from an employee’s browser to pull customer records at 2 a.m., with the same permissions that employee already has.
In each case, the person or the account is doing something it’s allowed to do. The problem lives in the request behind the action, and that’s the part malicious insider programs don’t look at.
Social engineering works because it borrows trust that already exists. It also clusters around predictable moments, like mergers and leadership changes, when unfamiliar requests feel normal. We dig into that pattern in Why Business Transitions Are Prime Time for Cyberattacks.
What to watch: Access and process signals, not coworkers
A more useful question than “Who might turn on us?” is “Where could an attacker borrow someone’s access?” That question points to processes and accounts, which is where compromised insider activity shows up:
- Requests that change where money or data goes, such as new payment details, new external sharing, or new email forwarding rules.
- Urgency or secrecy around a sensitive request, especially one that claims to come from an executive or a vendor.
- Account activity that doesn’t fit the person, like logins from new devices or locations, repeated MFA prompts, or access at unusual hours.
- Skipped process steps, like a missing second approval or a callback that never happened.
None of these requires monitoring what people say in chat or guessing what’s happening in their personal lives. Each one marks a moment of exposure, and the right response is to check in with the person and verify the request.
What helps
Insider risk management for the compromised insider comes down to two goals: Make manipulation harder to pull off and make it easier to report. These five steps do both, and insider threat prevention of this kind works best when it protects the people it covers.
Make reporting blame-free
The person most likely to notice a manipulation attempt is the person being targeted. Maybe the caller’s story didn’t add up, or they clicked a link and immediately had a bad feeling. Whether that becomes a five-minute report or a months-long cleanup depends on whether they believe speaking up will help them or get them in trouble.
Where NINJIO fits. Make reporting fast and make it safe. NINJIO ALERT gives people a one-click way to report a suspicious email from inside their inbox, and a quick thank-you from the cybersecurity team does more for the next report than any policy reminder.
NINJIO’s episode “Blame Game” follows an employee whose reports about suspicious activity go unheeded after information leaks, a reminder that reporting only works when someone listens.
Verify sensitive requests out of band
Confirm any request to move money, change payment details, reset credentials, or share sensitive data through a separate channel the requester didn’t supply. Call the number already on file or message the person on an account you know is theirs. When verification is a standard step, nobody has to feel awkward questioning a senior leader, because the process does the questioning for them.
This protects employees, too. A standard process means no one carries a high-stakes judgment call alone. For the personal side of the risk, see Business Email Compromise and Employee Liability: What Ohio’s Auditor Actually Said.
Train for the pressure that works on each person
Insider threat training for employees goes further than spotting a suspicious link. Compromised insider attacks work on authority, urgency, helpfulness, and the fear of letting someone down, and different people respond to different pressures. Training lands when it speaks to the pressure an attacker would use on that specific person.
Where NINJIO fits. NINJIO’s Emotional Susceptibility Profile uses phishing simulation results to show which emotional triggers each person responds to, and NINJIO SENSE offers coaching built around that profile.
Know who is exposed
Some roles draw more attention from attackers than others, including finance, HR, IT support, executive assistants, and anyone with admin rights or payment authority. Knowing which emotional triggers each group responds to lets you put verification steps and focused training where they’ll do the most good. The Emotional Susceptibility Profile builds that view from phishing simulations, not from monitoring anyone’s activity.
Plan the response with HR and legal
When an insider incident happens, the first few hours set the tone. Decide ahead of time who leads, how you’ll treat the employee involved, what you’ll document, and when HR and legal step in. A compromised employee is usually the attacker’s first victim, and the plan should treat them that way. A consistent, agreed-upon process also protects the organization in cases where intent turns out to be malicious.
Start with the people already on your side
Malicious insiders deserve a plan, and many organizations already have one. The bigger opening is the well-meaning employee on the other end of a convincing message. That risk shrinks when people know what manipulation looks like and trust that reporting it is the right call. For more on that mindset, read Why People Are the Biggest Opportunity in Cybersecurity.
See what pressure works on your people
The CISO’s Guide to Social Engineering Susceptibilities covers the emotional triggers attackers use and the steps security teams can take to prepare their workforce.
Frequently Asked Questions
A compromised insider is an employee, contractor, or partner whose access an attacker is using. Sometimes the attacker has stolen the person’s credentials and logs in as them. Other times, the attacker manipulates the person through phishing, a phone call, or a fake vendor request into taking an action they believe is legitimate.
The difference is intent. A malicious insider sets out to harm the organization, whether for money, out of a grievance, or because an outside group recruited them. A negligent insider makes a mistake with no intent to harm, like misdirecting a file or reusing a password. Negligent incidents account for the larger share of insider costs in Ponemon’s 2026 data.
Watch for requests and account behavior that don’t fit normal patterns. Common signals include changes to payment details or data-sharing settings, urgent or secretive requests from executives or vendors, logins from new devices or locations, repeated MFA prompts, and skipped approval steps. Employee reports can be the earliest signal, so make reporting easy and blame-free.
Focus on processes and access, not people’s private lives. Require out-of-band verification for sensitive requests, train employees on the specific pressure tactics attackers use, give them a simple way to report anything that feels off, and build a response plan with HR and legal that treats manipulated employees as victims. These steps lower risk while keeping the trust that makes people willing to speak up.
