Most security tools are built to keep strangers out. Insider threats are the opposite problem. The person already has a login, already has access to the files, and is already trusted. Nothing gets broken. Data just walks out.
It’s an expensive problem. Ponemon Institute’s 2026 Cost of Insider Risks Global Report, sponsored by DTEX, put the average annual cost of insider risk at $19.5 million per organisation. Most of that isn’t villains. The same report found careless and negligent insiders alone cost organisations an average of $10.3 million a year.
This post explains what an insider threat is, the three types, the signs each one leaves in Microsoft 365 and Google Workspace, and what to check first.
What is an insider threat?
An insider threat is a risk that comes from someone with legitimate access, such as an employee, contractor, partner or supplier, who misuses that access on purpose or by mistake.
The key word is legitimate. The account is allowed to open the files. The question is whether it should be doing so now, in this amount, and sending them where it is sending them. That’s why insider threats are hard to spot with tools that only look for break-ins. See our glossary entry on insider threat.
The three types of insider threats
| Type | What it looks like | Typical example |
|---|---|---|
| Malicious insider | Someone takes data or causes harm on purpose | A salesperson downloads the client list the week before joining a competitor |
| Careless insider | Someone means well but shares the wrong thing | A finance assistant pastes a payroll spreadsheet into a free AI tool to “tidy it up” |
| Compromised insider | A real account used by an attacker | A stolen password lets an attacker read the CFO’s mail and set up invoice fraud |
1. Malicious insiders
They are the rarest type, and the one people picture first. The usual trigger is leaving: a new job, a dispute, a layoff. Data tends to move in the last few weeks, often to personal email, a personal cloud drive or a USB stick.
2. Careless insiders
They are the most common type, and the hardest to blame. Someone shares a folder with “anyone with the link”, forwards mail to a personal address to work from home, or connects a handy AI app to their mailbox. Every one of those is a door left open. Shadow AI has made this much more frequent: people paste client data into chatbots because it saves time. Read AI data leaks for how that happens.
3. Compromised insiders
A compromised insider isn’t really an insider at all. It’s an attacker using a real person’s account. To most tools it looks exactly like the person. This is why insider risk and identity security overlap so much: the same signs that point to a leaver taking data also point to an attacker in a stolen mailbox.
The signs insider threats leave in Microsoft 365 and Google Workspace
Insiders don’t trip alarms, but they do leave traces. These are the signs worth watching:
Data moving out
- Large downloads or bulk file syncs, especially from sales, finance or HR folders.
- Files shared with personal email addresses, or links opened to “anyone”.
- Mail forwarding rules to an outside address.
- Company data pasted or uploaded into AI tools, especially on personal accounts.
Access changing
- An account suddenly gaining admin rights, or added to a group it never needed.
- New apps connected to a mailbox or drive with broad permissions.
- A new sign-in method added without a help-desk ticket.
Behaviour that doesn’t fit
- Activity far outside the person’s normal hours or normal files.
- Sign-ins from places or devices the person has never used.
- A spike in activity right after a resignation, a bad review or a contract ending.
Timing
- In leaver cases, data usually moves between the resignation and the last day. That’s the window to look harder.
None of these signs proves anything on its own. People download files for good reasons. What matters is the combination: a resignation, then a bulk download, then a share to a personal address is a pattern.
A worked example: the leaver and the client list
This is an illustrative example, not a real client. A 40-person accounting firm’s senior associate hands in notice on a Monday. Their last day is in three weeks.
- Tuesday. They sync the whole “Clients” folder from SharePoint to their laptop. That’s 3,200 files, against a usual handful a day.
- Wednesday. They create a mailbox rule forwarding anything from three key clients to a personal address.
- The following week. They upload a client fee spreadsheet to a free AI tool on a personal account to “build a summary”.
- The last day. Their account is disabled. The forwarding rule, the synced files and the AI tool account all stay.
Each step on its own looks like normal work. Put together, with the resignation date, it’s a clear picture. The firm’s fix, in order: remove the forwarding rule, check what was shared outside, revoke any apps the person connected, wipe the company data from the laptop through device management, and keep the records in case the firm needs them later.
How to reduce insider risk without spying on people
Insider risk programmes go wrong when they feel like surveillance. Most of the value comes from a few plain controls:
- Tie offboarding to HR. The moment notice is given, review the account: forwarding rules, shared links, connected apps, admin rights.
- Limit sharing by default. Make “people in your organisation” the default for links, and review anything shared with “anyone”.
- Block automatic forwarding to outside addresses, with named exceptions.
- Give people an approved AI tool. Careless insiders use personal AI tools because there’s no approved one. An AI usage policy plus an approved tool removes most of the reason.
- Watch identity, not just files. Compromised insiders are found through sign-ins, not downloads. See what is ITDR.
- Review admin rights monthly. Fewer admins means fewer accounts that can do real damage.
Checklist: insider threat basics
- Offboarding starts when notice is given, not on the last day.
- External mail forwarding is blocked, with named exceptions.
- Links shared with “anyone” are reviewed every month.
- Apps connected to mail and files are listed, with who approved them.
- People have an approved AI tool and a one-page AI policy.
- Bulk downloads and syncs from sensitive folders raise an alert.
- Admin rights are reviewed every month.
- Odd sign-ins are checked against the person’s normal places and devices.
How Centeye helps
Centeye Gatewatch watches every sign-in across Microsoft 365 and Google Workspace. It flags mail forwarded to outside addresses, accounts gaining admin rights or new sign-in methods, and sign-ins that don’t fit the person, so a compromised insider is caught as an account takeover. Centeye Lumen sees when company data is pasted or uploaded into AI tools, including personal accounts, without reading the content, and lists the AI apps each person has connected.
Frequently asked questions
What is an insider threat?
A risk that comes from someone who already has legitimate access, such as an employee, contractor or partner, misusing it on purpose or by mistake. It includes attackers using a real person’s account.
What are the three types of insider threats?
Malicious insiders who take data or cause harm on purpose, careless insiders who share the wrong thing by mistake, and compromised insiders, whose real accounts are being used by an attacker.
What are the most common signs of an insider threat?
Bulk downloads or syncs, files shared with personal addresses, mail forwarding to outside addresses, new admin rights, new connected apps, and activity that doesn’t fit the person’s normal hours or work, especially around a resignation.
Is insider risk only a problem for big companies?
No. Small businesses often have fewer controls, broader sharing and more people with admin rights, so one leaver or one careless share can expose a large share of client data.
How is insider threat detection different from ITDR?
They overlap. ITDR watches sign-ins and account changes, which catches compromised insiders. Insider risk adds the data side: what people download, share and paste. Both rely on knowing what’s normal for each person.
New to the terms? See insider threat, account takeover and shadow AI in our glossary.
Insider risk costs from Ponemon Institute, 2026 Cost of Insider Risks Global Report, sponsored by DTEX Systems, as published by DTEX. The worked example is illustrative.