Insider threats and data breaches: they’re not always what you think …
Insider threats and data breaches: they’re not always what you think …

insider threats by modern gangsterThere’s something you should know before you invest your entire IT and information security budget on technical solutions – if a smart thief wanted to steal your intellectual property and/or your client’s confidential information (e.g., credit, financial, and contact information taken during the Equifax data breach), they’d act like a gangster and walk in the front door and take it.


Why? When it comes to protecting what’s worth stealing, it’s your employeesnot your computers, that are the weakest link


Employees are within the human resources (HR) wheelhouse, so this is a topic of great importance to me. Some years ago, I worked in an organization that invested a lot of effort to keep its intellectual property and confidential employee information protected. This was done in two ways: (1) careful hiring and HR processes and (2) technical measures including firewalls, information security protocols, etc. Both approaches were necessary. It hasn’t become a popular concept, as yet, but it’s easy to argue that cybersecurity alone is not enough.




Many of us have heard of Edward Snowdon, the former NSA Subcontractor who disclosed an immense volume of confidential information to journalists and online sources. After working in an organization that shares some similarities with the NSA, I think it’s safe to say that the presence of sophisticated technical measures was not enough to prevent the intentional disclosure of confidential information. In fact, this scenario is an example of an Insider Threat.


“Insider threats can be defined as risks posed by rogue employees who deliberately cause harm, or by those who may be negligent in the workplace.


insider threats - snowdon a patriot or traitor


Some insider threats are non-malicious or accidental, whereas others are malicious and intentional. Malicious threats may be driven by principles or ideology (e.g., Edward Snowden), or they could be motivated by anger or disenchantment in the workplace. A malicious insider threat can also develop when someone on staff is recruited and groomed by an outside organization” (Corporate Security Hinges on its People, FrontLine Security Magazine, October 2017).



If insider threats are a real problem why isn’t it better known?


analog insider threats

Not all data breaches are external or digital …

Most of us have heard about data breaches that have occurred in organizations that have much bigger security budgets than ours. For example, the NSA and Equifax breaches that I just mentioned. Plus, there have been big breaches at Yahoo, Home Depot, Target, and others. I’ve done extensive research on this topic and one thing is crystal clear: 75% of these data breaches originate inside organizations. Often, we don’t hear about the causes of those breaches because they make the organization look terrible. It has a negative impact on the public’s trust and confidence in the organization’s ability to protect corporate information, including clients’ and/or customers’ personal information. When an organization experiences a security breach, their current and future clients, strategic partners/affiliates, and members of the general public are likely to see the organization as irresponsible. Negative financial consequences usually follow. Approximately 60% of smaller companies are bankrupt within 6 months of a major security breach, so it’s no wonder this is kept quiet.


How can HR, based on I/O psychology help?

I’m addressing this topic because I understand that HR has an important role to play in preventing these insider threats. One problem is that most organizations don’t recognize that HR can make valuable contributions to the risk management process. Another problem is that the C-suite and the IT/information security folks don’t necessarily recognize the role that HR could be playing to keep confidential intellectual property and client information from leaking out of the organization. For example, many organizations don’t address workplace bullying as proactively or completely as they could. They haven’t understood the link between malicious insider threats that are inspired by anger or a desire for revenge that comes from being severely mistreated at work. The consequences of ongoing suffering in toxic workplaces are even more severe when essential government services and critical infrastructure are at risk. So, if the threat of lost productivity and lawsuits aren’t a big enough justification for improving HR policies and practices, the likelihood of insider threats should catch the attention of key decision-makers.


If you’d like to learn more about how psychology and HR can help prevent insider threats, listen to Episode 27 of The Insider Threat Podcast where I speak to host Steve Higdon about this topic. Note – since the time that this article was published, I was an invited guest on Scott Wright and Tom Eston’s Shared Security Podcast and we spoke about different aspects of this issue.


Have a sensitive career or HR-related concern? I invite you to contact me by emailphone, or via direct message on Twitter, Facebook, or LinkedIn if you’d like to discuss any of these topics in more detail.


More than career coaching, it’s career psychology®.


I/O Advisory Services – Building Resilient Careers and Organizations.


Easily share this article using any of the social media icons below!

Latest Posts

The Importance of Trust in Remote and Hybrid Workplaces

The Importance of Trust in Remote and Hybrid Workplaces

Many professionals are still working remotely or in hybrid work environments. While this type of arrangement can be great for convenience, productivity, fostering creativity and better use of resources, one issue I keep thinking about is the challenge associated with building trust.

Leaders and the Self-Awareness Gap

Leaders and the Self-Awareness Gap

Leaders: how accurate is your understanding of your impact on others? According to the Industrial/Organizational Psychologists at Psychometrics.com, 95 percent of leaders believe they are self-aware, while a shocking 10-15 percent actually are. Ouch, that’s a big...

Self-Awareness is Crucial for Leaders

Self-Awareness is Crucial for Leaders

Do you know how others view you as a leader? Regardless of where you are in your career, self-awareness is a key building block for effective leadership. Being conscious of our strengths and weaknesses helps us develop and provides insight into how others perceive us.

“The Great Work Breakup” and What Women Want (Part Two)

“The Great Work Breakup” and What Women Want (Part Two)

Women are demanding more from work, and to get what they want, they’re switching jobs at the highest rate possibly in history. The pandemic kicked off the Big Quit; now we’re into “the Great Breakup.” Women are no longer putting up with conditions that don’t work for them. Some of them are even “rage-applying” …