What insider risk means

Two words that are not the same thing

An insider is anyone whose legitimate access to systems, premises or information comes from a relationship with the organisation: employees, contractors, temporary staff, suppliers with a login, and former staff whose access was never withdrawn. That relationship is the whole definition. It says nothing about intent.

Insider risk

The standing exposure created by granting people access. It exists in every organisation that employs anyone, it never reaches zero, and it is managed rather than removed.

Insider threat

A specific person acting, or preparing to act, against the organisation using that access. It is an event, not a condition, and most organisations see very few of them.

Conflating the two is the most common failure in this subject. A programme built to hunt threats treats every employee as a suspect and collapses under its own false positives. A programme built to manage risk spends most of its effort on access design, leaving investigation as the rare exception it should be.

Why it is harder than external intrusion

External defence has a clean question to answer: should this party be inside at all? Insider work has no such question available. The access was granted deliberately, the activity is frequently indistinguishable from the person's job, and the same log line can be a routine export or the beginning of a loss depending on facts that are not in the log.

• The actor already holds credentials, so authentication tells you nothing.
• The actor knows where the valuable material is, so reconnaissance is short or absent.
• The actor often knows what is monitored, so avoidance is cheap.
• The response is an employment matter as much as a technical one, so it moves at the speed of process rather than of tooling.

What this chapter does not do