Insider Threat.

What is an insider threat?

CISA says an insider threat is the potential for an insider to use their authorized access or understanding of an organization to harm that organization. An insider is a person who has or had authorized access to, or knowledge of, the organization’s resources.

NIST gives a similar definition in its glossary. It describes the threat that an insider will use authorized access, wittingly or unwittingly, to do harm to the security of the United States. Wittingly means on purpose. Unwittingly means without meaning to.

Who counts as an insider?

CISA says the resources an insider may have access to or knowledge of include personnel, facilities, information, equipment, networks and systems. CISA also says the person can be someone who had access in the past, not only someone who has it now.

What harm can an insider threat cause?

CISA says the harm can come from intentional or unintentional acts. These acts can negatively affect the integrity, confidentiality and availability of the organization, its data, its personnel or its facilities. CISA gives examples that include terrorism, workplace violence and cybersecurity breaches.

NIST says the harm can happen through espionage, terrorism, unauthorized disclosure, or the degradation of resources or capabilities.

Is every insider threat intentional?

No. Both CISA and NIST include acts that are not done on purpose. A person who causes harm by mistake still falls inside the definitions, because the definitions cover unintentional acts and unwitting use of access.

How can an organization reduce insider threat?

CISA describes a four-step approach: define, detect and identify, assess, and manage. CISA says an insider threat mitigation program can combine physical security, personnel awareness and information-centric principles. CISA’s manage step covers monitoring and mitigation to prevent incidents.

• Define: set out what the insider threat means for the organization.
• Detect and identify: look for signs of risk early.
• Assess: judge the risk that has been found, including whether a person could cause harm.
• Manage: act on the risk that has been assessed.

Is an insider threat the same as an outside attacker?

No. The key difference is in the definition. An insider already has authorized access or knowledge, or had it before. This is different from a person with no such access. Related terms are credential theft, which is about stolen login details, and data exfiltration, which is about data leaving an organization. These are separate ideas that can sometimes appear in the same incident.

Does an insider threat have to involve computers?

No. CISA’s definition covers people, facilities, equipment, information, networks and systems. Its examples include workplace violence as well as cybersecurity breaches. This page focuses on the cyber side, but the term is wider.

Where does awareness fit in?

CISA lists personnel awareness as one part of an insider threat program. Security awareness training is a related term, and it covers teaching staff about security risks.

In the 2025 Coupang breach in South Korea, official and press sources describe the actor as a former employee.