May 6, 2026 • Tom Abuta

Introduction

You might be looking outside yet the employee in the next office can cause your biggest lose.

In January 2024, an incident attributed to “human error” was confirmed by Mercedes-Benz. GitHub token with unrestricted and unmonitored internal access was published online. This exposed source code, cloud credentials, and sensitive infrastructure data including SSO password and systems blueprints.

$19.5 million is the average cost to organizations on insider risks. It has been established by Verizon DBIR that 30% of all data breach are attributed to insiders. Unlike external bad actors, insider risks result from employee who you see and trust have the best interest of the organization. They are interwoven on the daily workflows, their log in credentials don’t cause alarm on the Monitoring and detection systems, they understand business operations and have legitimate access to virtually most of the organization’s assets.

Even though 83% of organizations experience at least one insider attack, only 25% report having a fully mature insider risk program with defined metrics and executive oversight. This just goes to show how many organizations fear and plan for external attacks and forget one of the lethal attacks - Insider attacks.

Insider threat/ insider attacks are risk that originate from within the organization. This emanates from an insider who use their authorized access or understanding of an organization to harm that organization. It is important to note that the insider may case this not out of malicious intent but due to negligence. It is recorded that careless insiders actually cause a greater number of incidents than the disgruntled employee.

Most Common Inside threat actors fall in this category.

1. Negligent Insider

Negligent insiders do not intend to cause harm. They however do through careless or uninformed behavior. They are generally aware of the security policies in place but choose to ignore. An employee allowing someone to piggyback through a secure entrance point, or Sales person ignoring messages to install new updates and security patches are some of the characteristics of such employee.

2. Malicious insider

Malicious insiders intentionally perform actions that will harm the organization. They are employee with authorized access data. They use this information in unethical methods for financial gain or to get back to organizations. A recently fired employee sharing sensitive information to competitor or disgruntled employee exposing trade secrets to the public are common instance of these types of attack.

 In 2022 Yahoo sued a former employee for allegedly stealing valuable intellectual property through downloading approximately 570,000 pages of proprietary source code, advertising algorithms and internal documents after securing a job offer from Trade Dek who are a direct competitor.

3. Compromised Insider

A user whose account credentials have been breached may enable an attacker to gain unrestricted access to sensitive company assets. This activity can go unnoticed since valid credential are utilized. This might not trigger traditional security alerts. Credentials might be stolen through stealing (Access Card), social engineering or a user installing an application from unauthorized sites. According to Dataguard this are the costliest threats to fix with an estimated cost of $ 804 000 per incident.

Challenges to Preventing Insider threats

Limited Detection:  Many organizations lack comprehensive systems to monitor such attacks. This creates a visibility gap and allowing data exfiltration or policy violations to go unnoticed. Only 36% of organizations have a fully integrated insider threat solution that is able to deliver unified visibility and control.

Legitimate Access and Trust: Insider attacks are silent. Reason they already have the Keys to the system. The IDS will not create an alarm or traffic prohibited by the firewall. It makes it difficult to notice when a user is abusing such access.

Complexity of user behavior: It is a difficult task to figure out what is normal and not normal to every employee in the organizations. Every user operates differently at different moments. Even with the best insider threat indicators, setting an acceptable baseline for normal activity for all is challenging.

Limitation of Security measures: There is no perfect security measure. Even after implementing solid security controls and risk management plans, an insider can cause a human error that opens the door to a great attack.

Detecting and Preventing Insider Threats

Detecting and preventing insider threats requires a more rigorous approach. It not only entails catching the bad guy but going far and beyond to create an environment where such attacks can’t succeed. The implementation of such measures should be supported and reinforced by every member especially the executive leadership.

1. Strong Security Policies

This may sound administrative. However, Security policies are the first line of defense against insider attracts. They create a strong backbone for the organization cyber security strategy. Set procedures that ensure only authorized personnel have access to valuable data resources, implement Role Based Access Control (RBAC) and Principle of least privilege. All this policies act as the guiding path to how sensitive data and critical assets are accessed within the organizations.

2. Technology Solutions

It is prudent to understand that it is not a matter of plugging one solution and concluding you are safe. The technological solutions implemented should cut across, monitoring activities in your system, analyzing users’ behaviors which entails (time, assets being accessed and amount of activity from such users) to detection of any malicious activity. This should further be prevented by robust response tools and proper analysis of the system to ensure the threat is completely dealt with.

5. Data Protection Measures

Sensitive data cannot be made available to just anyone. It requires concrete measures. By implementing executable employment agreements and non-disclosure is one steps towards ensuring sensitive data remains protected. This however requires an extra layer of protection through configuring data loss prevention (DLP). This tools control and monitor your data transfers. They alert unauthorized attempts of data transfers. This allows an organization catch a threat before it escalates.

4. Training and Awareness

In cybersecurity Knowledge will always be part of the defense mechanism. Regular training sessions and awareness programs can turn your employes into human firewall. Conducting simulations will enable your personnel to understand better how to spot phishing attack and understand tricks used by attackers to perform social engineering.

5. Working with a trusted partner

In Kenya alone 4.56 billion incidents were detected between October and December. This is a 441.27 % surge in cyber threat incidents. Can your organization deal with such percentage increase in less than three months? This should guide decision makers to allow the experts come in and help. This eventually save the organization from greater lose indicated above. The benefits derived from working with experts are: comprehensive security solutions tailored to your business, all round monitoring of your system, detection, prevention and timely response. Most often than not organizations need an extra shield of protection.

Ready to assess your organization's Security Posture? Let us talk.

Telephone: +254 728223333 | +254 717335467
Email: cybersecurity@southendtech.coke | info@southendtech.co.ke | dataprotection@southendtech.co.ke

South-End Tech Limited — Helping businesses build visible and Cyber-resilient Enterprises.

Comments (0)