Insider threats and data breaches: they’re not always what you think …
Insider threats and data breaches: they’re not always what you think …

insider threats by modern gangsterThere’s something you should know before you invest your entire IT and information security budget on technical solutions – if a smart thief wanted to steal your intellectual property and/or your client’s confidential information (e.g., credit, financial, and contact information taken during the Equifax data breach), they’d act like a gangster and walk in the front door and take it.


Why? When it comes to protecting what’s worth stealing, it’s your employeesnot your computers, that are the weakest link


Employees are within the human resources (HR) wheelhouse, so this is a topic of great importance to me. Some years ago, I worked in an organization that invested a lot of effort to keep its intellectual property and confidential employee information protected. This was done in two ways: (1) careful hiring and HR processes and (2) technical measures including firewalls, information security protocols, etc. Both approaches were necessary. It hasn’t become a popular concept, as yet, but it’s easy to argue that cybersecurity alone is not enough.




Many of us have heard of Edward Snowdon, the former NSA Subcontractor who disclosed an immense volume of confidential information to journalists and online sources. After working in an organization that shares some similarities with the NSA, I think it’s safe to say that the presence of sophisticated technical measures was not enough to prevent the intentional disclosure of confidential information. In fact, this scenario is an example of an Insider Threat.


“Insider threats can be defined as risks posed by rogue employees who deliberately cause harm, or by those who may be negligent in the workplace.


insider threats - snowdon a patriot or traitor


Some insider threats are non-malicious or accidental, whereas others are malicious and intentional. Malicious threats may be driven by principles or ideology (e.g., Edward Snowden), or they could be motivated by anger or disenchantment in the workplace. A malicious insider threat can also develop when someone on staff is recruited and groomed by an outside organization” (Corporate Security Hinges on its People, FrontLine Security Magazine, October 2017).



If insider threats are a real problem why isn’t it better known?


analog insider threats

Not all data breaches are external or digital …

Most of us have heard about data breaches that have occurred in organizations that have much bigger security budgets than ours. For example, the NSA and Equifax breaches that I just mentioned. Plus, there have been big breaches at Yahoo, Home Depot, Target, and others. I’ve done extensive research on this topic and one thing is crystal clear: 75% of these data breaches originate inside organizations. Often, we don’t hear about the causes of those breaches because they make the organization look terrible. It has a negative impact on the public’s trust and confidence in the organization’s ability to protect corporate information, including clients’ and/or customers’ personal information. When an organization experiences a security breach, their current and future clients, strategic partners/affiliates, and members of the general public are likely to see the organization as irresponsible. Negative financial consequences usually follow. Approximately 60% of smaller companies are bankrupt within 6 months of a major security breach, so it’s no wonder this is kept quiet.


How can HR, based on I/O psychology help?

I’m addressing this topic because I understand that HR has an important role to play in preventing these insider threats. One problem is that most organizations don’t recognize that HR can make valuable contributions to the risk management process. Another problem is that the C-suite and the IT/information security folks don’t necessarily recognize the role that HR could be playing to keep confidential intellectual property and client information from leaking out of the organization. For example, many organizations don’t address workplace bullying as proactively or completely as they could. They haven’t understood the link between malicious insider threats that are inspired by anger or a desire for revenge that comes from being severely mistreated at work. The consequences of ongoing suffering in toxic workplaces are even more severe when essential government services and critical infrastructure are at risk. So, if the threat of lost productivity and lawsuits aren’t a big enough justification for improving HR policies and practices, the likelihood of insider threats should catch the attention of key decision-makers.


If you’d like to learn more about how psychology and HR can help prevent insider threats, listen to Episode 27 of The Insider Threat Podcast where I speak to host Steve Higdon about this topic. Note – since the time that this article was published, I was an invited guest on Scott Wright and Tom Eston’s Shared Security Podcast and we spoke about different aspects of this issue.


Have a sensitive career or HR-related concern? I invite you to contact me by emailphone, or via direct message on Twitter, Facebook, or LinkedIn if you’d like to discuss any of these topics in more detail.


More than career coaching, it’s career psychology®.


I/O Advisory Services – Building Resilient Careers and Organizations.


Easily share this article using any of the social media icons below!

Latest Posts

Scary Work: Revisiting Some Haunting Past Situations

Scary Work: Revisiting Some Haunting Past Situations

The real-life corporate psychopath usually isn’t the over-the-top caricature of a masked, axe-wielding maniac chasing his victims down a dark alley. But, when we’re unlucky, corporate psychopaths do walk among us. They can have an extremely detrimental impact on their peers and people who report to them, and can hurt the organization for which they work. There are also other things happening to some of us that make for scary work situations.

The Big Quit Continues: Why Employees are Unhappy at Work

The Big Quit Continues: Why Employees are Unhappy at Work

Job dissatisfaction is at an all-time high. Despite fears of a recession, the Big Quit is still underway, with more and more people quitting their jobs in search of something better. I’ve written previously about the Big Quit phenomenon, and how the uncertainty of the pandemic has impacted our work-related choices. Certainly, wages are a major factor in this decision-making process. With the cost of living rising and wages not keeping pace, it’s no wonder that people are looking for greener pastures. But there’s one key factor that’s driving a lot of churn in organizations …

Black Psychology – What is it and why is it important?

Black Psychology – What is it and why is it important?

While largely unknown, Black Psychology as a discipline has an established history. As a graduate student, Dr. Helen stumbled upon a book called Black Psychology (Third Edition) which was published in 1991. The book addressed the need to develop a Black perspective on the conceptualization, research, and practice of Psychology. So many years later, with so few Black psychologists in Canada and the United States, there still is a significant gap in the field. This Q&A blog provides a quick overview.