Insider threat
In risk terms, an insider threat is the risk that somebody with legitimate access uses it against the organisation, whether deliberately, carelessly, or because their account has been taken over by an outsider. The third case is the most common, and it is why the category cannot be separated from ordinary access control.
How it works
Three profiles, with different mechanisms and different countermeasures. The malicious insider acts knowingly, usually around a leaving date, a grievance or an outside incentive, and takes data they are entitled to see. The negligent insider causes the outcome without intent: data sent to the wrong recipient, a database exposed to the internet, a file share opened to everyone to unblock a colleague. The compromised insider is an external attacker operating a real employee’s account, which from a monitoring perspective is indistinguishable at the point of authentication.
All three share one property that makes them hard: nothing has been bypassed. There is no exploit, no unusual authentication and no privilege boundary crossed, so controls built around blocking illegitimate actions are not engaged.
What goes wrong
The countermeasures are the ordinary ones, applied. Least privilege limits what any single account can reach, which is the only control that reduces all three profiles at once. Data classification decides what is worth watching, because monitoring everything produces alerts nobody reads. Data loss prevention detects movement of what matters. Logging on data access, not just on authentication, is what makes reconstruction possible afterwards.
What we find instead is broad standing access and no record. Everyone in a department can read the whole share because permissions were set once and grew, and there is no audit of reads, so the question of what a departing employee took cannot be answered at all. That is not an insider control failure; it is an access control failure that only becomes visible when somebody leaves.
The other recurring gap is the leaver process, which handles the mail account and misses the personal cloud storage sync, the third-party application still consented, and the credentials in a repository. See non-human identity for the part nobody offboards.
Where this shows up in an audit
In a due diligence this is a documentation and configuration review rather than an intrusion: which roles can reach which data, how joiners and leavers are processed, whether data access is logged and retained, and what the target could prove about a departure that has already happened. An assumed-breach engagement answers the related technical question, which is what an ordinary employee account can actually reach, and the answer is routinely far more than anyone expected. This is part of how insider risk is assessed in a due diligence.