Log in Request a demo

Glossary

Insider Threat.

Also called insider risk, insider threats

In Short

An insider threat is the potential for a person with authorized access to, or knowledge of, an organization to use that access to harm it. The harm can be intentional or unintentional. CISA describes the term this way, and NIST gives a similar definition.

Last updated October 23, 2026
Profile MapGlossary Term
  1. Also Called2other namesinsider risk · insider threats
  2. Related Terms3linked entriesCredential theft · Data exfiltration · Security awareness training

What Is an Insider Threat?

CISA says an insider threat is the potential for an insider to use their authorized access or understanding of an organization to harm that organization. An insider is a person who has or had authorized access to, or knowledge of, the organization’s resources.

NIST gives a similar definition in its glossary. It describes the threat that an insider will use authorized access, wittingly or unwittingly, to do harm to the security of the United States. Wittingly means on purpose. Unwittingly means without meaning to.

Who Counts as an Insider?

CISA says the resources an insider may have access to or knowledge of include personnel, facilities, information, equipment, networks and systems. CISA also says the person can be someone who had access in the past, not only someone who has it now.

What Harm Can an Insider Threat Cause?

CISA says the harm can come from intentional or unintentional acts. These acts can negatively affect the integrity, confidentiality and availability of the organization, its data, its personnel or its facilities. CISA gives examples that include terrorism, workplace violence and cybersecurity breaches.

NIST says the harm can happen through espionage, terrorism, unauthorized disclosure, or the degradation of resources or capabilities.

Is Every Insider Threat Intentional?

No. Both CISA and NIST include acts that are not done on purpose. A person who causes harm by mistake still falls inside the definitions, because the definitions cover unintentional acts and unwitting use of access.

What Are the Four Steps of Insider Threat Mitigation?

CISA describes a four-step approach: define, detect and identify, assess, and manage. CISA says an insider threat mitigation program can combine physical security, personnel awareness and information-centric principles. CISA’s manage step covers monitoring and mitigation to prevent incidents.

  • Define: set out what the insider threat means for the organization.
  • Detect and identify: look for observable, concerning behavior early.
  • Assess: a team judges a person of concern on behavior, not profiles. The aim is to prevent an incident, and the response should focus on helping the person.
  • Manage: coordinate approved measures to monitor and reduce the risk.

How Do You Build an Insider Threat Program?

The CISA Insider Threat Mitigation Guide (2026 edition) groups the build work into four areas: plan, organize and equip, train and execute, and evaluate and improve.

Building an Insider Threat Program, Step by Step
  1. Win executive supportCISA says programs aligned with senior leadership are the most effective and meet fewer obstacles.
  2. Start from what existsViolence prevention or IT and cybersecurity programs can be the foundation.
  3. Form a governance groupInclude the business functions the program touches, and address legal obligations.
  4. Name the assets to protectIdentify high-value assets so effort goes where harm would be greatest.
  5. Plan the response and reportingWrite an incident response plan and set up reporting pathways.
  6. Train, then add toolsRun a formal training program, then use technology to spot concerning behavior.
  7. Set up a threat management teamGive it a risk rubric and a method for threat assessment.
  8. Test and auditRun exercises and provide oversight, including internal audits.

Is an Insider Threat the Same as an Outside Attacker?

No. The key difference is in the definition. An insider already has authorized access or knowledge, or had it before. This is different from a person with no such access. Related terms are credential theft, which is about stolen login details, and data exfiltration, which is about data leaving an organization. These are separate ideas that can sometimes appear in the same incident.

What Types of Insider Threat Does CISA Describe?

CISA separates unintentional threats, which are negligent or accidental, from intentional ones. It adds collusive threats, where an insider works with an outside actor, and third-party threats from contractors or vendors with access. See the CISA page on defining insider threats.

Does an Insider Threat Have to Involve Computers?

No. CISA’s definition covers people, facilities, equipment, information, networks and systems. Its examples include workplace violence as well as cybersecurity breaches. This page focuses on the cyber side, but the term is wider.

Where Does Awareness Fit In?

CISA lists personnel awareness as one part of an insider threat program. Security awareness training is a related term, and it covers teaching staff about security risks.

This page gives the short definition. For a longer look, read our article on insider threat management.

Also Called.

  • Nameinsider risk
  • Nameinsider threats

Questions.

  • What is an insider threat?

    CISA says an insider threat is the potential for an insider to use their authorized access or understanding of an organization to harm it. An insider is a person who has or had authorized access to, or knowledge of, its resources.

  • Is every insider threat intentional?

    No. Both CISA and NIST include acts that are not done on purpose. A person who causes harm by mistake still falls inside the definitions, because they cover unintentional acts and unwitting use of access.

  • How can an organization reduce insider threat?

    CISA describes a four-step approach: define, detect and identify, assess, and manage. It says a program can combine physical security, personnel awareness and information-centric principles, and that the manage step covers monitoring and mitigation.

  • Is an insider threat the same as an outside attacker?

    No. An insider already has authorized access or knowledge, or had it before. An outside attacker has no such access, so the two are different problems, even though both can appear in the same incident.

Sources

  1. 1 Insider Threat Mitigation, CISA
  2. 2 insider threat - Glossary | CSRC, NIST
  3. 3 Insider Threat Mitigation Guide: 2026 Edition, CISA
  4. 4 Defining Insider Threats, CISA
  5. 5 Detecting and Identifying Insider Threats, CISA
  6. 6 Assessing Insider Threats, CISA
  7. 7 Managing Insider Threats, CISA

In Our Research

  1. 1 Mitigating Insider Threats: Combining Technology and Employee Awareness April 2025
  2. 2 Proactive Insider Threat Management: Advanced Strategies for 2024 July 2024
  3. 3 Mitigating Insider Threats: Strategies for Protecting Your Organization November 2023
  4. 4 Insider Threats: Identifying and Mitigating Risks from Within November 2023
  5. 5 North Korea AI Hacking: What Microsoft Documented Across Eight Groups October 2026
  6. 6 Why Your CISO Is Your Organization’s Highest-Value Attack Target May 2026

Keep Exploring.

Knowledge Hub
Article Supply Chain Attack Examples And Tactics, With A Case Study Supply chain attack examples explained: SolarWinds, NotPetya, the Shai-Hulud npm worm and 2026 cases. See the tactics, stages and what to do next. Open Glossary term Least Privilege Least privilege is a security principle that gives each user, process or system only the access it needs to do its job, and no more. Open Article Data Breach Prevention: Brandefense’s Approach To Risk Management Data breach prevention explained: what a breach is, the main threat vectors such as phishing and ransomware, and practical steps to lower your risk. Open Glossary term Incident Response Plan An incident response plan is a written set of instructions for how an organization detects, responds to, and limits the harm from a cyber attack. Open

Browse The Library.