Research brief
A background brief for evidence review
Insider threats are risks posed by people who have or previously had authorized access to an organization, including employees, contractors and business partners. Harm can be intentional or accidental and can affect information, systems and operations. [1, 2]
This brief focuses on digital access and information handling. Its central recommendation is to distinguish deliberate misuse, mistakes and compromised accounts before attributing intent. Account activity is evidence to investigate, not a complete explanation of who acted or why.
A mistake can expose information without an intention to cause harm. Examples include sending a file to the wrong recipient or granting an inappropriate permission. [2]
An external attacker may act through stolen credentials. Some insider incident studies include this category, but the account owner should not be assumed to be the actor. [5]
Security, insider risk and investigation teams, together with leaders responsible for access governance and accountable review.
02 / Full report
The checklist below is a practical synthesis for this brief. It is not a validated scoring system or a test of an individual. CISA recommends corroboration, contextual assessment and attention to mitigating information. [1]
Describe the specific event, affected asset, time and source. Separate a log entry, a witness report and an analyst interpretation.
Keep the original record, collection context and known gaps. Note whether clocks, identifiers and account records can be reliably matched.
Check the person’s role, permissions, task and approval history. Consider shared accounts, service accounts and possible credential compromise.
Ask whether a scheduled job, approved transfer, changed duties, configuration error or mistaken destination could explain the event.
Compare independent records where available. Document both supporting and conflicting evidence, along with what remains unknown.
Use established incident and personnel processes. Record the decision, responsible reviewer and reason for any escalation or access restriction.
A large file transfer outside usual working hours may warrant review. Was it an approved backup, a legitimate task in another time zone, an error, or unauthorized extraction? The observation alone does not establish an explanation. This is a hypothetical example, not a reported incident.
Limit review to relevant, lawfully obtained information and authorized roles. Protect privacy, civil rights and civil liberties. Give mitigating evidence a place in the record. Avoid demographic profiling or conclusions based on appearance, emotion or a presumed psychological condition. [1]
03 / Full report
Use a combination of access governance, clear working practices and incident preparation. Select controls for the organization’s systems and obligations rather than treating any single tool as a complete solution.
Review and update accounts when responsibilities change or employment ends. Remove access that is no longer required. [3]
Give users and processes only the access their assigned tasks require. Review privileged permissions deliberately. [3]
Define what to log, who reviews it and how findings are escalated. Treat unusual activity as a prompt for analysis, not a verdict. [3]
Explain approved ways to handle information and report mistakes. Tailor training to actual duties and common failure points. [2]
Define responsibilities for detection, analysis, containment and recovery. Preserve evidence and use lessons from incidents to improve the process. [3]
In March 2019, a remote login system was used to shut down a Kansas water treatment plant and turn off a filter. The U.S. Department of Justice reported that investigators linked the intrusion to the phone of a former employee who had resigned that January. DOJ announced his guilty plea in October 2021. [4]
The case illustrates why former access relationships and remote access deserve scrutiny. The public release does not establish a specific account removal failure, water contamination or physical injury. An access lifecycle review is a practical lesson drawn here, not a finding attributed to DOJ.
What information or service is at risk, which access path matters, and what action would reduce that exposure while preserving evidence and fair review?
04 / Full report
The 2022 Ponemon study, sponsored by Proofpoint, reported about US$15.4 million in average annual organizational costs associated with insider incidents. It did not report that amount as the average cost of one incident. The sample contained 278 organizations that had experienced material insider incidents, with fieldwork concluding in September 2021. [5, 6]
This is a historical benchmark from a selected sample, not a current estimate for every organization or a measure of any one sector. Its definition includes credential theft. Do not treat it as a universal breach rate or compare it directly with a differently defined breach dataset.
This revision synthesizes public government guidance, a primary case account and an identified industry study. It contains no original dataset, interviews or empirical evaluation. The checklist is editorial guidance rather than a tested assessment method. Historical evidence is dated explicitly; this is not a comprehensive review of current threat activity or a product performance evaluation.
Prepared on 24 October 2026. The original report page was dated 1 April 2025.
CISA
November 2020
Definition, contextual assessment and privacy safeguards. Pages 10, 35, 73 and 76.
Canadian Centre for Cyber Security
4 June 2024
Intentional and accidental harm, access controls and training.
NIST
Revision 5, 2020
Account management, least privilege, audit review and incident handling.
U.S. Department of Justice
21 October 2021
Primary account of the March 2019 incident and October 2021 guilty plea.
Ponemon Institute
2022
Annual cost and sample scope. Pages 7, 9, 10 and 19. Sponsored by Proofpoint.
Proofpoint
25 January 2022
Sponsor summary and study methodology.