Insider threats and data breaches: they’re not always what you think …
Insider threats and data breaches: they’re not always what you think …

insider threats by modern gangsterThere’s something you should know before you invest your entire IT and information security budget on technical solutions – if a smart thief wanted to steal your intellectual property and/or your client’s confidential information (e.g., credit, financial, and contact information taken during the Equifax data breach), they’d act like a gangster and walk in the front door and take it.


Why? When it comes to protecting what’s worth stealing, it’s your employeesnot your computers, that are the weakest link


Employees are within the human resources (HR) wheelhouse, so this is a topic of great importance to me. Some years ago, I worked in an organization that invested a lot of effort to keep its intellectual property and confidential employee information protected. This was done in two ways: (1) careful hiring and HR processes and (2) technical measures including firewalls, information security protocols, etc. Both approaches were necessary. It hasn’t become a popular concept, as yet, but it’s easy to argue that cybersecurity alone is not enough.




Many of us have heard of Edward Snowdon, the former NSA Subcontractor who disclosed an immense volume of confidential information to journalists and online sources. After working in an organization that shares some similarities with the NSA, I think it’s safe to say that the presence of sophisticated technical measures was not enough to prevent the intentional disclosure of confidential information. In fact, this scenario is an example of an Insider Threat.


“Insider threats can be defined as risks posed by rogue employees who deliberately cause harm, or by those who may be negligent in the workplace.


insider threats - snowdon a patriot or traitor


Some insider threats are non-malicious or accidental, whereas others are malicious and intentional. Malicious threats may be driven by principles or ideology (e.g., Edward Snowden), or they could be motivated by anger or disenchantment in the workplace. A malicious insider threat can also develop when someone on staff is recruited and groomed by an outside organization” (Corporate Security Hinges on its People, FrontLine Security Magazine, October 2017).



If insider threats are a real problem why isn’t it better known?


analog insider threats

Not all data breaches are external or digital …

Most of us have heard about data breaches that have occurred in organizations that have much bigger security budgets than ours. For example, the NSA and Equifax breaches that I just mentioned. Plus, there have been big breaches at Yahoo, Home Depot, Target, and others. I’ve done extensive research on this topic and one thing is crystal clear: 75% of these data breaches originate inside organizations. Often, we don’t hear about the causes of those breaches because they make the organization look terrible. It has a negative impact on the public’s trust and confidence in the organization’s ability to protect corporate information, including clients’ and/or customers’ personal information. When an organization experiences a security breach, their current and future clients, strategic partners/affiliates, and members of the general public are likely to see the organization as irresponsible. Negative financial consequences usually follow. Approximately 60% of smaller companies are bankrupt within 6 months of a major security breach, so it’s no wonder this is kept quiet.


How can HR, based on I/O psychology help?

I’m addressing this topic because I understand that HR has an important role to play in preventing these insider threats. One problem is that most organizations don’t recognize that HR can make valuable contributions to the risk management process. Another problem is that the C-suite and the IT/information security folks don’t necessarily recognize the role that HR could be playing to keep confidential intellectual property and client information from leaking out of the organization. For example, many organizations don’t address workplace bullying as proactively or completely as they could. They haven’t understood the link between malicious insider threats that are inspired by anger or a desire for revenge that comes from being severely mistreated at work. The consequences of ongoing suffering in toxic workplaces are even more severe when essential government services and critical infrastructure are at risk. So, if the threat of lost productivity and lawsuits aren’t a big enough justification for improving HR policies and practices, the likelihood of insider threats should catch the attention of key decision-makers.


If you’d like to learn more about how psychology and HR can help prevent insider threats, listen to Episode 27 of The Insider Threat Podcast where I speak to host Steve Higdon about this topic. Note – since the time that this article was published, I was an invited guest on Scott Wright and Tom Eston’s Shared Security Podcast and we spoke about different aspects of this issue.


Have a sensitive career or HR-related concern? I invite you to contact me by emailphone, or via direct message on Twitter, Facebook, or LinkedIn if you’d like to discuss any of these topics in more detail.


More than career coaching, it’s career psychology®.


I/O Advisory Services – Building Resilient Careers and Organizations.


Easily share this article using any of the social media icons below!

Latest Posts

How to Stand Out in an Interview: Part One

How to Stand Out in an Interview: Part One

The interview is going so well. Your answers are flowing naturally; you feel like you’re nailing it; the job is yours for sure. You feel it starting to wind down, and you know what’s coming next. “Why should we hire you? Why do you think you’re the best candidate for this job?”

What’s Your Leadership Style? Part Two

What’s Your Leadership Style? Part Two

In Part One of this two-part series, we looked at Autocratic and its opposite approach, Democratic/Participative leadership styles. This time, in Part Two I’ll describe Transformational, Delegative and Transactional leadership styles.

What’s Your Leadership Style? Part One

What’s Your Leadership Style? Part One

When it comes to leadership styles, which one is right for you? Each style has its own benefits and drawbacks, so if you’re in a position of leadership it’s important to figure out which one will work best for you and your organization or business.

Changing Jobs? Avoid These Interview Red Flags

Changing Jobs? Avoid These Interview Red Flags

With the Turnover Tsunami or the Great Resignation creating an employee-driven job market, employers in all sectors are facing a challenge in identifying and attracting qualified new candidates. Despite the challenge, it doesn’t mean employers want to lower their standards. Just because candidates may be harder to find, it doesn’t mean you’re the only viable candidate. In this blog, Dr. Helen identifies some red flags that job candidates should avoid displaying – even in a tight labour market.