Cybersecurity: The Calls are Coming from Inside the House

A belated Happy National Insider Threat Awareness Month to those who celebrate. In keeping with the season, this Forrester blog highlights the fact that insider incidents account for 25% of cybersecurity breaches – and up to 1/3rd of these involve malicious intent.  Despite those statistics, the blog says that many organizations still lack dedicated insider risk management teams or functions. As this excerpt explains, that’s a problem:

Insider incidents involving intellectual property theft, sabotage, and unauthorized data exfiltration can cost organizations financially as well have impacts such as ceded competitive advantage, lost opportunities, and diminished customer trust. These are organizations’ potential: the future innovations in which they’ve invested, the ability to deliver for customers, and future customer relationships. Insider incidents can take away that potential.

Insiders have inside knowledge of their organization. They know what the crown jewels are and where they are stored. Insiders may also have some knowledge of how those crown jewels are secured. Managing insider risk requires specific focus to protect against insider incidents, detect them, and respond to them.

The blog also says that the insiders organizations need to worry about aren’t just the human ones – while insider risk management has traditionally focused on employees, AI agents represent a new type of insider due to their ability to access information, make decisions and act autonomously. Accordingly, information security teams need to be aware of the risks posed by the AI agents that their organizations create and enable.