For CISOs, boards, and risk leadership

    The single destination for understanding and reducing insider risk.

    A working library for security, HR, legal, and executive teams — live incident reporting, a fifteen-year case archive, and a growing set of assessment tools and briefings, built around one principle: insider risk is a people, data, and governance problem, not only a monitoring one.

    12Live interactive tools & generators
    700+Documented incidents, 2010–2026
    65+Briefings & articles in development
    Explore the hub: use the Insider Risk Newsroom, the Insider Threat and Insider Risk Updates archive, the interactive assessment tools, the Leadership Briefing Series, and the Research & Content Library to support insider risk awareness, research, and program planning.

    Insider Risk Newsroom

    Live · hand-researched snapshot

    Coverage limited to stories with a genuine insider-origin angle — a malicious, negligent, departing, or third-party insider at the center of the story. General breaches, malware, and vendor CVEs with no insider angle are deliberately left out.

    Open the Newsroom in full ↗ Ask Claude to “refresh the insider risk wire” any time to re-research and republish it.
    ◈
    CURATED SNAPSHOT · INSIDER-ORIGIN INCIDENTS ONLY

    Insider Risk Wire

    SNAPSHOT · SEP 17, 2026
    Insider risk · insider threat · nothing else

    News about people, not perimeters.

    Every story here involves someone with legitimate access — an employee, a contractor, a departing hire — who caused harm, was accused of it, or is at the center of new insider-risk tooling, policy, or litigation. External hacks, generic malware, and vendor CVEs are left out on purpose.

    How this is kept current: a browser can’t safely pull live RSS into a hosted page, so this is a hand-researched snapshot instead of an auto-refreshing feed. Ask Claude in this chat to “refresh the insider risk wire” any time and it will re-research and republish this page with new cases.
    —Stories in this snapshot
    —Publishers cited
    Sep 17Snapshot date

    Lead case

    —

    Insider-risk coverage, Jan–Sep 2026

    Sorted newest first

    Global Insider Threat Archive

    Live · 2010–2026

    A chronological record of documented insider-threat incidents, spanning espionage, trade-secret theft, sabotage, leaks, and compromised access, drawn from DOJ filings, FBI releases, SEC actions, and court dockets. The full archive is filterable by year and category — a sample of recent, independently sourced cases is shown below.

    Malicious2026

    Bank Manager Admits $335K Customer Account Theft

    A branch manager used forged withdrawal slips and a coworker’s credentials to drain more than 20 customer accounts and two local nonprofits over several years.

    DOJ Plea Agreement, Sept 2026 ↗
    Espionage2026

    Insider-Threat Specialist Pleads Guilty to Attempted Espionage

    A DIA insider-threat analyst admitted leaving classified files on a thumb drive for who he believed was a foreign government before being caught by an undercover FBI operation.

    DOJ / FBI, Aug 2026 ↗
    Sabotage2026

    Twin Brothers Convicted for Wiping 96 Federal Databases

    Rehired despite prior hacking convictions, the pair deleted 96 government databases across 45+ agencies within an hour of being fired, using AI tools to help erase forensic evidence.

    DOJ / FDIC-OIG, May 2026 ↗
    Espionage2026

    Cyber Division Executive Sentenced for Selling Exploits to Russia

    Former Trenchant general manager Peter Williams was sentenced to 87 months after selling eight zero-day exploits to a Russian broker for up to $4 million.

    DOJ / U.S. Treasury, Feb 2026 ↗
    Compromised access2026

    AI Assistant Exploited as One-Click Insider Data-Exfiltration Vector

    Researchers disclosed prompt-injection flaws letting a single malicious link turn a trusted Copilot session into a channel exfiltrating mailbox and SharePoint data with the user’s own permissions.

    Varonis Threat Labs, 2026 ↗
    Leak2026

    Negotiator Leaked Client Strategy to BlackCat Ransomware Gang

    A ransomware negotiator secretly fed BlackCat attackers confidential details of his employer’s clients’ negotiating positions and insurance limits in exchange for payment.

    DOJ, Mar 2026 ↗
    Open the full 15-year archive ↗ Filter by year (2010–2026) and by six incident categories in the full archive.

    Interactive Assessment Tools

    Live · 16 resources

    Sixteen self-serve tools and resource hubs for assessing insider risk, estimating cost and ROI, generating policies, reviewing access, and supporting threat research and response planning — built for security, HR, legal, and executive teams. Each resource is intended for educational use.

    Live

    Insider Risk & Insider Threat Assessment

    Scores governance, HR coordination, detection, response, privacy, third-party controls, and offboarding, with a maturity score and recommended next steps.

    Live

    Insider Incident Cost Estimator

    Estimates the likely financial impact of an insider incident based on data type, headcount, and detection speed.

    Live

    Insider Risk Program ROI Calculator

    Models the return on investment of building or expanding an insider-risk program against expected incident reduction.

    Live

    Insider Risk Program Staffing & Budget Estimator

    Recommends headcount, roles, and budget ranges for an insider-risk program based on organization size and maturity target.

    Live

    Acceptable Use & Data Handling Policy Generator

    Generates a customized acceptable-use and data-handling policy draft ready for legal and HR review.

    Live

    Insider Threat Program Charter Generator

    Builds a program charter defining scope, governance, roles, and authority for a new or existing insider-threat program.

    Live

    Tabletop Exercise Scenario Generator

    Generates realistic insider-risk tabletop scenarios — suspicious downloads, a resignation, stolen credentials, contractor abuse — to pressure-test response plans.

    Live

    High-Risk Offboarding Checklist

    Interactive checklist covering identity, devices, tokens, repositories, cloud services, privileged access, shared credentials, and post-exit monitoring.

    Live

    Privileged Access Review Tracker

    Tracks and schedules recurring reviews of privileged accounts and access grants across systems and owners.

    Live

    Shadow IT and SaaS Discovery Checklist

    Walks through discovery steps for unsanctioned apps, browser extensions, and SaaS tools that create unmonitored exfiltration paths.

    Live

    Decision Support Hub: Escalation Tree & NIST CSF Mapper

    An interactive escalation tree paired with a NIST CSF mapper to guide response decisions during a live incident.

    Live

    Advanced Extensions Hub: Vendor Risk, Remote Audit & Roadmap

    Extends the core program with vendor-risk scoring, a remote-audit workflow, and a forward-looking program roadmap.

    Live

    AI Security Information Tool

    Explore AI security information and supporting resources for assessing risks associated with AI systems.

    Live

    AI Resource Hub

    Access AI focused information and resources relevant to security, governance, and risk awareness.

    Live

    Threat Intelligence Hub

    Explore threat intelligence resources to support threat awareness and security research.

    Live

    Attack Matrix

    Review attack techniques and structured threat references to support security assessment and response planning.

    Leadership Briefing Series

    Published resources

    Briefing material for security leaders, HR, legal teams, and executives. These links lead to existing Cybersecurity Threat & AI resources, not vendor sponsored content. Use them to support leadership discussions about insider risk, trusted access, employee behavior, and the security implications of AI agents.

    Research & Content Library

    Published resources

    A curated collection of existing Cybersecurity Threat & AI articles and reference pages on insider threats, insider risk management, detection, AI identities, and trusted access. This library prioritizes independent editorial resources and excludes Gurucul authored content.

    AI and Emerging Insider Risk

    Explore how agent identities, delegated permissions, and AI enabled workflows can expand the insider risk surface.

    AI Agent Insider Risk and Shadow Identity ↗

    Practical Program Tools

    Apply the research through assessments, planning tools, and operational templates available on Cybersecurity Threat & AI.

    Insider Risk Assessment ↗ Insider Incident Cost Estimator ↗ Insider Threat Program Charter Generator ↗

    Reference and Updates

    Use the updates archive for ongoing coverage, and the glossary pages for foundational terminology.

    Insider Threat Definition ↗ Insider Risk Explained ↗ Full Insider Threat and Insider Risk Updates Archive ↗

    Additional Insider Risk Resources by Source

    Newsletters · Blog · Glossary · Knowledge Pages

    More insider risk and insider threat material collected from the site’s LinkedIn Newsletter Backlinks, Blog, Glossary, and Knowledge Pages inventories. Gurucul Threat Entries and Gurucul authored material are excluded.

    Insider Risk & Insider Threat Glossary

    Reference pages

    Start with the core definitions and follow the linked reference pages for more detail.

    Core Definitions

    Insider Threat↗
    A risk arising when someone with authorized access may use that access in a way that harms an organization, its people, or its information.
    Insider Risk↗
    The broader exposure created by malicious actions, mistakes, compromised accounts, and misuse of legitimate access.
    Behavioral Analytics↗
    Analysis of activity patterns and context to help identify behavior that may require investigation.

    Governance and Access

    Privacy Aware Insider Risk Management↗
    A risk management approach that considers proportionality, privacy, governance, and legitimate business needs.
    AI Agent Identity Risk↗
    Risk that arises when AI agents use identities, credentials, permissions, or tools without clear ownership and oversight.
    Trusted Access↗
    Authorized access that still requires appropriate review, context, and accountability.

    Editorial Standards

    Live

    Sourcing

    Every newsroom and archive entry is checked individually for a genuine insider-origin angle — a malicious, negligent, departing, or third-party insider at the center of it — before publication. General breaches, malware, and vendor CVEs with no insider angle are excluded by design.

    Facts, allegations, and findings

    Coverage distinguishes confirmed facts from allegations, company statements, law-enforcement findings, and expert interpretation. Where a source is uncertain, the item is left out rather than published with an invented attribution.

    Privacy by design

    Interactive tools will use privacy-conscious, proportionality-aware language throughout, and the program’s editorial position is that insider risk is a people, data, identity, and governance problem — not only a monitoring one.