Key Insights
Insider incidents get more expensive the longer they run. The 2026 Cost of Insider Risks Global Report from the Ponemon Institute puts the average annual cost at $14.2 million when organizations contain an incident within 30 days. But only 13% of incidents are contained inside the 30-day window. Containment costs rise to $21.9 million after 90 days.
Those figures track what happens once trusted access has already been abused. They also point to the same underlying problem behind the incidents that follow: trusted access, once granted, does not automatically shrink when a person's role, employment, or intentions change.
Insider threat examples share a common thread: trusted access, once granted, does not automatically shrink when a person's role, employment, or intentions change. For security and IT leaders, that gap between granted access and current risk is where some of the costliest incidents on record began.
The cases ahead trace sabotage, intellectual property theft, nation-state infiltration, and credential compromise through the specific sequence of employment events, access decisions, and system activity that produced each outcome. Understanding them together points to the controls, review triggers, and governance choices that separate a contained incident from a public breach.
Key Takeaways
Trusted access changes how harm occurs, whether the person acts deliberately or becomes the source of harm through carelessness or outside control.
Real incidents become useful when organizations examine the sequence of human behavior and system activity that produced the eventual outcome.
Effective prevention combines technical safeguards and consistent governance with attention to human context and fair process.
Human context and system evidence must be evaluated together to understand insider activity accurately.
What Is an Insider Threat?
An insider threat is the potential for someone with authorized access to an organization, or knowledge of how it works, to cause harm deliberately or through carelessness. Harm can also occur because an outsider is operating through that person's credentials. Trust, not job title, is what defines an insider for security purposes. Current and former employees qualify, as do contractors, vendors, and business partners who hold or once held legitimate access to systems, facilities, or data.
An insider threat and an external attack differ in the actor's starting point. An outside attacker has to defeat controls built to keep strangers out; an insider is already past them, so perimeter defenses say little about what that person does next. External actors may recruit insiders with cash or obtain credentials through phishing attacks. Some also pose as remote employees using stolen identities. The harm still travels through trusted access, even when the person directing it sits outside the organization.
Types of Insider Risk Behind Real Incidents
Insider incidents follow recurring patterns: malicious activity includes intellectual property theft, sabotage, fraud, and espionage, while non-malicious cases involve careless handling or access that an outsider has taken over.
Malicious, Collusive, and Nation-State Insiders
Malicious insiders act on purpose, and the motive behind that intent shapes both the warning signs and the controls that matter most. Sorting these incidents by what the insider was after helps reviewers match the right response to the right pattern:
Intellectual Property Theft: Intellectual property thieves are typically departing employees who believe the designs or code they built belong to them. This profile is called the entitled independent.
Sabotage: Saboteurs usually act on a grievance. The CISA insider threat guide cites a study of sabotage incidents in which 85 percent of insiders held a grievance before acting, and most of those grievances were work-related. Management reduced Davis Lu's responsibilities before he planted code that crashed servers, while Roger Duronio set off a logic bomb across most of his employer's network after not receiving an expected bonus. Authorized access gave both men the means to turn dissatisfaction into harm.
Fraud: Fraud turns a trusted position into a revenue stream, as when a U.S. Department of Agriculture (USDA) employee in a fraud-detection unit sold confidential program information to criminals.
Espionage: Espionage replaces personal motive with state direction, as with the chemist who stole trade secrets for bisphenol A (BPA)-free can coatings on behalf of Chinese entities while moving between two U.S. employers.
Collusion: Collusion cuts across these categories when a leader recruits other insiders to steal for a new business or competitor.
Each role change, announced departure, instance of unusual file movement, or case of access beyond a current job need may have an ordinary explanation. Their relationship can justify proportionate review and help distinguish an ordinary personnel event from conduct moving toward theft, fraud, sabotage, or espionage.
Negligent, Compromised, and Extended-Trust Insiders
Non-malicious and extended-trust incidents can produce the same account activity through very different causes, and the right response depends on which one is in play. Distinguishing these categories up front keeps reviewers from treating a revocation gap like a compromise, or a mistake like intent:
Negligent Insiders: These insiders cause harm without meaning to. Storing access keys in a personal code repository fits this pattern. CISA experienced that scenario when a contractor exposed credentials in a personal repository, after which the agency took its development environment offline and revoked the contractor's access.
Compromised Insiders: In these cases, an outsider operates through a trusted identity. Phishing and credential theft, along with other forms of social engineering, can make the employee whose identity an attacker took an unwitting insider. Behavioral AI, such as Abnormal's approach to account takeover detection, is designed to flag the login and communication anomalies a compromised identity leaves behind, often before the attacker moves further into connected systems.
Extended-Trust Insiders: Former employees, contractors, partners, and staffing agencies may retain knowledge or access after their role changes or ends. Recurring reviews and least-privilege access controls reduce that exposure.
The activity alone may not reveal which category applies. A valid account using an unfamiliar session could indicate compromise, while continued access after a contract ends may reflect a revocation gap rather than deliberate misconduct. Reviewers need account history and employment context before deciding how to respond. They also need to examine the destination of the activity.
Negligence calls for safer handling and narrower access. Compromise calls for stronger authentication and attention to unfamiliar sessions, while extended trust calls for recurring access review and explicit revocation. Treating every event as deliberate misconduct would obscure these distinctions and could lead to the wrong response.
Real Incidents and the Lessons They Left Behind
Human events and system activity often combine with control failures before harm occurs.
Departing-Employee Intellectual Property Theft at an Autonomous Driving Company
Anthony Levandowski, a founding engineer on his employer's self-driving car project, downloaded proprietary files, including schematics, source code, and sensor designs, to a personal laptop shortly before he resigned. He moved the files to an external drive and deleted traces of the transfer. Civil litigation with the rideshare company he later joined uncovered the theft and triggered a criminal referral. Federal prosecutors indicted him, he pleaded guilty, and a judge sentenced him to prison and financial penalties. The rideshare company settled the civil case with an equity payment.
A bulk download far above the engineer's normal file activity, followed by a transfer to removable media, provided a signal for review. Baselining file access per role would have made the spike visible, while logging removable-media use to storage the user could not alter would have preserved evidence. Controls work best when those thresholds reflect the person's role and established activity rather than a generic transfer limit.
That combination also creates a practical review path. Reviewers can test whether current project needs explain the transfer, preserve the relevant records, and examine the destination without treating resignation itself as proof of theft. The sequence shows why the relationship between volume, destination, timing, and employment status matters more than a single alert.
Post-Departure Cloud Sabotage at a Networking Equipment Vendor
Sudhish Kasaba Ramesh resigned and kept his credentials to the company's cloud infrastructure for months. He then deployed code from a personal cloud project that deleted virtual machines supporting the company's collaboration application. His code shut down accounts on that application, and the company spent heavily on remediation and customer refunds. A judge sentenced Ramesh to prison, fined him, and placed him under supervised release. Investigators traced the login to his new workplace.
The authentication logs showed a departed employee's credentials connecting from an unfamiliar network months after he left. Offboarding that stops at corporate accounts leaves cloud credentials live and turns a routine separation gap into an avenue for deliberate destruction. Cloud consoles, API keys, service accounts, and cloud application logins each need explicit revocation.
Revocation also needs verification because removing a primary directory account does not prove that separate cloud credentials have stopped working. In practice, the human resources (HR) separation record should reconcile against every system covered by identity and access management, not merely the primary corporate directory. Authentication records can then confirm that the departed user's access has actually ended.
Long-Term Espionage at an Aerospace Contractor
Dongfan "Greg" Chung, an engineer at two aerospace contractors, collected restricted space and aviation technology for the People's Republic of China over many years. A jury convicted him of economic espionage and related charges, and he was later sentenced to a lengthy prison term. Prolonged access to controlled technology without a review of whether it matched his job created the gap.
Employee Recruitment at an Electric-Vehicle Plant
Egor Kriuchkov, a Russian national, offered an employee at an electric-vehicle plant in Nevada a large payment to support a malware installation attempt that would steal data for extortion. The employee reported it, the company called the FBI, and the FBI recorded further conversations. Kriuchkov pleaded guilty. An employee's ability to report the approach without fear of blame made the reporting control effective.
Remote-Worker Infiltration by North Korean Operatives
North Korean nationals have used stolen U.S. identities and domestic laptop farms to take remote IT jobs; one Arizona facilitator placed workers at companies before receiving a prison sentence. The scale of the scheme became clearer when the Department of Justice reported in June 2025 that North Korean nationals had held remote IT positions at many U.S. companies and that the FBI had seized laptops in coordinated searches tied to the operation.
This pattern demands identity verification for remote hires and due diligence on staffing intermediaries, along with monitoring for remote-access hardware on company laptops. Each of the three pathways above enters through a different trust decision, so no single technical control can address all of them.
Credential Compromise Through Online-Platform Phishing
Social engineering can lure an employee to a deceptive landing page that captures credentials. An outside attacker can then authenticate as that employee and reach internal systems and data through a legitimate account. A session from an unfamiliar device or location shortly after the employee visited a deceptive lookalike domain may indicate compromise. Awareness and training help employees recognize the approach, while authentication controls make a captured password less useful.
Several contextual signals help determine whether the trusted identity still represents the trusted employee:
Device and Location: An unfamiliar device or network can show that the session differs from the employee's established activity.
Timing: A successful login shortly after a deceptive page visit can connect the social-engineering attempt with later access.
Resource Use: The account's permissions and the resources reached determine the potential exposure.
Employment Context: Current responsibilities help reviewers assess whether the activity has a legitimate business explanation.
Password capture is only the first stage of the incident. Abnormal's behavioral AI is designed to correlate these session and device signals with an account's established communication patterns, helping surface account-takeover risk without waiting for a user to report it. A low-privilege identity and a broadly entitled identity create different levels of exposure, even when the attacker uses the same method to obtain the password. Authentication records, device details, and location information help test whether the employee likely initiated the session.
A deceptive page visit may appear harmless in isolation, as may a later successful login. Even ordinary-looking resource access can escape notice unless reviewers examine the combined view. That view supports a response to account compromise without assuming deliberate employee misconduct.
Warning Signals and Controls From Insider Threat Incidents
The signals in these insider threat examples fall into two groups, employment events and access anomalies, and interpreting them requires both human context and system evidence.
Employment Events, Data Movement, and Access Anomalies
In the cases discussed above, resignation, demotion, discipline, or termination preceded the incident. A reduction in responsibilities can precede sabotage, which is why HR events belong in a security team's field of view. Only a change from a person's own baseline should draw attention; stress or mental health issues by themselves fall outside that standard. An employment event justifies review, but reviewers must verify conduct before reaching a finding.
Technical signals include data movement far above a role's baseline, use of personal email or cloud storage from work systems, after-hours access outside an established pattern, and authentication after a departure date. Data movement monitoring is particularly useful around an announced resignation, and risk continues after the person's last day. Comparing access with current responsibilities, established behavior, destination, timing, and employment status gives reviewers a broader pattern instead of an isolated alert. That context supports proportionate review without treating routine role changes as evidence of misconduct.
Cross-Functional Governance and Proportionate Response
The National Institute of Standards and Technology's (NIST) insider threat framework connects insider-risk programs to incident handling, least privilege, audit review, personnel termination, and awareness training. A cross-discipline incident handling team can draw on HR, legal, physical security, IT, and law enforcement to operationalize those connections. The cases show why: HR may know about reduced responsibilities while IT can see related code or access changes, and neither fact alone amounts to a case. Addressing a grievance can also change an individual's trajectory before anything malicious happens.
Teams must share context proportionately. Access reviews and audit log retention can apply to everyone. Alerts on bulk data movement can do the same, while targeted scrutiny should follow a documented trigger, involve legal and HR, and preserve fair-process rights. Managers can add information about current job needs or role changes, but reviewers still need system evidence before drawing conclusions.
A trusted reporting process matters too: Kriuchkov's recruitment attempt failed because an employee felt safe enough to report the offer. These contributions let the organization investigate conduct rather than personal characteristics or unsupported assumptions.
Turn Insider Threat Examples Into Better Decisions
Across these cases, recurring failures arose when organizations did not connect personnel changes, trusted access, and system activity. Assessing recent departures, role changes, and phishing incidents as linked sequences can reveal which signals an organization would miss and where its next control improvement should begin.
For the account-based side of insider risk, where compromised identities and phishing-driven credential theft turn trusted employees into unwitting insiders, Abnormal can help close the visibility gap. Its behavioral AI models each user's established communication patterns, then correlates session and device signals to surface account takeover activity before an attacker moves further into connected systems. Security Posture Management adds a complementary view by flagging risky Microsoft 365 configuration changes, such as new forwarding rules or multi-factor authentication weakening, that often accompany insider misuse or a compromised account.
Abnormal was named a Customers' Choice in the 2026 Gartner® Peer Insights™ Voice of the Customer for Email Security, the only vendor to earn the recognition three consecutive times. To see how behavioral AI can strengthen your defenses against compromised insiders and account-based threats, book a demo with Abnormal.
Frequently Asked Questions
What Evidence Should Teams Preserve During an Insider Investigation?
Relevant evidence may include authentication records, file-access logs, removable-media events, cloud activity, and the timeline of role or employment changes. Records should remain in storage the user under review cannot alter. Legal, HR, and security involvement can help keep preservation proportionate to the documented trigger.
How Can Insider Threat Monitoring Respect Employee Privacy?
Broad controls such as access reviews and audit-log retention can apply consistently to everyone. Targeted scrutiny should follow a documented trigger, focus on conduct rather than personal characteristics, and involve legal and HR where appropriate. This approach supports investigation while preserving fair-process rights.
When Should Teams Contact Law Enforcement About Insider Activity?
Contact may be appropriate when evidence indicates trade secret theft or sabotage. Outside recruitment may also warrant contact. Early reporting can help investigators preserve evidence before harm occurs.