Your security team is thinking about

insider risk all wrong

Dear renegades, mavericks, and deviants,

Your security team is probably thinking about insider risk all wrong.

They're out there hunting villains when they should be looking at everyone. Why? Because an insider isn't necessarily someone who wants to cause harm; an insider is anyone with the access to do so.

And let's be honest: most insider risk programs are built like manhunts. They rely on surveillance tools, threat hunting, and behavioral red flags that scream "malicious actor!" in an alarmingly shrill voice. The entire apparatus is designed to catch bad people doing bad things.

Except here’s the problem: 75% of the time, there is no villain. More than 2 out of 3 insider risk incidents are caused by negligence, not malice.  According to the Ponemon Institute's 2025 research, the breakdown of insider incidents is eye-opening:

• 55% negligence: People just trying to get their jobs done
• 20% credential theft: Outsiders exploiting insiders
• Only 25% malice: Actual ‘bad actors’

That means 3 out of 4 incidents have absolutely nothing to do with intent.

The myth of the ‘bad actor’

MITRE’s research categorizes these non-malicious incidents even further:

• The negligent: They know the rules but bypass them for reasons such as convenience or speed.
• The mistaken: They make genuine errors for a variety of reasons, such as stress or resource gaps.
• The outsmarted: They’re victims of social engineering who’ve been tricked into a trap.

These aren't criminals. They're normal employees having bad moments.

When security becomes the problem

When a security team treats risk like a criminal investigation, they respond to a simple mistake the same way they’d respond to sabotage: with supervisor reports and disciplinary action.

The result? You make it worse

Employees who were merely mistaken or outsmarted now feel punished, helpless, and resentful. Vigilance drops, trust erodes, and the very behaviors you’re trying to prevent become more likely. Worse yet, by framing the issue as ‘catching bad people,’ security teams effectively lock you — the people experts — out of the conversation. These aren’t all bad people. But they might still present insider risks.

Why they need you

Insider risk is fundamentally about human behavior. As HRM professionals, security culture, and behavioral security specialists, you are the ones who know how to influence behavior without treating everyone like a suspect. You know how to design systems that make the secure choice the easy choice. You know the difference between someone who needs education, someone who needs help, and someone who’s just burnt out and cutting corners.

But none of that matters if your security team is still operating under the ‘Insider Risk = Insider Threat’ delusion.

Take your seat at the table

The truth is, your organization needs your expertise. They just don't know it yet. They’re missing the forest for the trees by focusing on intent rather than capability, opportunity, and context.

So, if your security team is still treating insider risk like a manhunt, it's time to challenge them.

Share this with your Insider Threat Lead or CISO. Help them see the full picture. Because until they realize insider risk is about human behavior — not just bad intentions — they will keep failing.

And you'll keep being left out of the conversation where you could be making the biggest difference.

— Oz A

P.S. Struggling to get a seat at the table? Book some time with me here. I've helped dozens of HRM professionals reposition their value to organizations that didn't ‘get it’ at first. Let's figure out your move.

Oz Alashe

CEO and Founder, CybSafe

What did you think of today's email?

Your feedback helps me create better emails for you!

Was this email forwarded to you? Sign up here.