An insider threat is the risk that a person with authorized access uses it, intentionally or unintentionally, to harm an organization. CISA and NIST both define it in these terms. Insiders can be employees, former staff whose access was not removed, contractors, suppliers or partners.

How it works

• Malicious insiders steal data, sabotage systems or sell access for money, revenge or ideology.
• Negligent insiders cause harm by mistake, for example by mishandling data or falling for phishing.
• Compromised insiders have their accounts taken over by outside attackers, who then act with the insider’s rights.
• Criminal groups sometimes recruit staff directly, offering payment for logins or for running malware.

Why it matters for dark web monitoring

Insider activity is hard to detect because the access is legitimate. Least privilege, offboarding checks, logging and behavior analytics such as UEBA help. Some warning signs appear outside the network: offers to sell a company’s internal data or access, recruitment posts aimed at its staff, or internal documents posted on forums. Watching these sources, alongside leaked company data, can reveal an insider problem that internal tools miss.

Sources: CISA: Defining Insider Threats, NIST CSRC Glossary: insider threat