The single destination for understanding and reducing insider risk.
A working library for security, HR, legal, and executive teams — live incident reporting, a fifteen-year case archive, and a growing set of assessment tools and briefings, built around one principle: insider risk is a people, data, and governance problem, not only a monitoring one.
Six pillars, one program
Jump to any section — live resources are marked accordingly.
Insider Risk Newsroom
Curated, insider-origin-only news — malicious, negligent, departing-employee, and third-party cases, updated on request.
LiveGlobal Threat Archive
Fifteen years of documented insider-threat incidents, filterable by year and category.
LiveInteractive Assessment Tools
Twelve live tools: risk assessment, cost and ROI calculators, policy and charter generators, checklists, and decision-support hubs.
Published resourcesLeadership Briefing Series
Curated briefings for CISOs, HR, legal teams, and executives, linked to published insider risk resources.
Published resourcesResearch & Content Library
Existing insider risk articles, AI risk research, reference pages, and practical assessment tools.
LiveEditorial Standards
How sources are verified, how corrections work, and what stays out by design.
Insider Risk Newsroom
Live · hand-researched snapshotCoverage limited to stories with a genuine insider-origin angle — a malicious, negligent, departing, or third-party insider at the center of the story. General breaches, malware, and vendor CVEs with no insider angle are deliberately left out.
Global Insider Threat Archive
Live · 2010–2026A chronological record of documented insider-threat incidents, spanning espionage, trade-secret theft, sabotage, leaks, and compromised access, drawn from DOJ filings, FBI releases, SEC actions, and court dockets. The full archive is filterable by year and category — a sample of recent, independently sourced cases is shown below.
Bank Manager Admits $335K Customer Account Theft
A branch manager used forged withdrawal slips and a coworker’s credentials to drain more than 20 customer accounts and two local nonprofits over several years.
DOJ Plea Agreement, Sept 2026 ↗Insider-Threat Specialist Pleads Guilty to Attempted Espionage
A DIA insider-threat analyst admitted leaving classified files on a thumb drive for who he believed was a foreign government before being caught by an undercover FBI operation.
DOJ / FBI, Aug 2026 ↗Twin Brothers Convicted for Wiping 96 Federal Databases
Rehired despite prior hacking convictions, the pair deleted 96 government databases across 45+ agencies within an hour of being fired, using AI tools to help erase forensic evidence.
DOJ / FDIC-OIG, May 2026 ↗Cyber Division Executive Sentenced for Selling Exploits to Russia
Former Trenchant general manager Peter Williams was sentenced to 87 months after selling eight zero-day exploits to a Russian broker for up to $4 million.
DOJ / U.S. Treasury, Feb 2026 ↗AI Assistant Exploited as One-Click Insider Data-Exfiltration Vector
Researchers disclosed prompt-injection flaws letting a single malicious link turn a trusted Copilot session into a channel exfiltrating mailbox and SharePoint data with the user’s own permissions.
Varonis Threat Labs, 2026 ↗Negotiator Leaked Client Strategy to BlackCat Ransomware Gang
A ransomware negotiator secretly fed BlackCat attackers confidential details of his employer’s clients’ negotiating positions and insurance limits in exchange for payment.
DOJ, Mar 2026 ↗Interactive Assessment Tools
Live · 16 resourcesSixteen self-serve tools and resource hubs for assessing insider risk, estimating cost and ROI, generating policies, reviewing access, and supporting threat research and response planning — built for security, HR, legal, and executive teams. Each resource is intended for educational use.
Insider Risk & Insider Threat Assessment
Scores governance, HR coordination, detection, response, privacy, third-party controls, and offboarding, with a maturity score and recommended next steps.
LiveInsider Incident Cost Estimator
Estimates the likely financial impact of an insider incident based on data type, headcount, and detection speed.
LiveInsider Risk Program ROI Calculator
Models the return on investment of building or expanding an insider-risk program against expected incident reduction.
LiveInsider Risk Program Staffing & Budget Estimator
Recommends headcount, roles, and budget ranges for an insider-risk program based on organization size and maturity target.
LiveAcceptable Use & Data Handling Policy Generator
Generates a customized acceptable-use and data-handling policy draft ready for legal and HR review.
LiveInsider Threat Program Charter Generator
Builds a program charter defining scope, governance, roles, and authority for a new or existing insider-threat program.
LiveTabletop Exercise Scenario Generator
Generates realistic insider-risk tabletop scenarios — suspicious downloads, a resignation, stolen credentials, contractor abuse — to pressure-test response plans.
LiveHigh-Risk Offboarding Checklist
Interactive checklist covering identity, devices, tokens, repositories, cloud services, privileged access, shared credentials, and post-exit monitoring.
LivePrivileged Access Review Tracker
Tracks and schedules recurring reviews of privileged accounts and access grants across systems and owners.
LiveShadow IT and SaaS Discovery Checklist
Walks through discovery steps for unsanctioned apps, browser extensions, and SaaS tools that create unmonitored exfiltration paths.
LiveDecision Support Hub: Escalation Tree & NIST CSF Mapper
An interactive escalation tree paired with a NIST CSF mapper to guide response decisions during a live incident.
LiveAdvanced Extensions Hub: Vendor Risk, Remote Audit & Roadmap
Extends the core program with vendor-risk scoring, a remote-audit workflow, and a forward-looking program roadmap.
LiveAI Security Information Tool
Explore AI security information and supporting resources for assessing risks associated with AI systems.
LiveAI Resource Hub
Access AI focused information and resources relevant to security, governance, and risk awareness.
LiveThreat Intelligence Hub
Explore threat intelligence resources to support threat awareness and security research.
LiveAttack Matrix
Review attack techniques and structured threat references to support security assessment and response planning.
Leadership Briefing Series
Published resourcesBriefing material for security leaders, HR, legal teams, and executives. These links lead to existing Cybersecurity Threat & AI resources, not vendor sponsored content. Use them to support leadership discussions about insider risk, trusted access, employee behavior, and the security implications of AI agents.
Insider Risk: What Leaders Need to Understand
Establishes the difference between insider risk and insider threat, and explains why risk can arise from malicious actions, mistakes, compromised accounts, or misuse of legitimate access.
Read briefingInsider Risk Management Is Not Employee Surveillance
Supports leadership discussion about proportional controls, privacy, context, and responsible ways to reduce insider risk without creating a culture of constant surveillance.
Read briefingTrusted Access and Insider Threat Awareness
Explores why trusted access needs ongoing attention and how awareness, clear processes, and timely access reviews help reduce preventable incidents.
Read briefingInsider Threat Detection and Behavioral Analytics
Explains how behavioral context can help teams distinguish unusual activity from meaningful risk and investigate signals without relying on isolated alerts.
Read briefingAI Agents, Shadow Identities, and Insider Risk
Examines how AI agents and their identities can gain access to business systems, creating new questions around ownership, permissions, accountability, and monitoring.
Case briefing10 Real Life Insider Threat Examples
Use real-world examples to help leaders discuss common insider threat patterns, the conditions that enable them, and the controls that can reduce exposure.
Research & Content Library
Published resourcesA curated collection of existing Cybersecurity Threat & AI articles and reference pages on insider threats, insider risk management, detection, AI identities, and trusted access. This library prioritizes independent editorial resources and excludes Gurucul authored content.
Insider Risk and Threat Research
- Insider Risk Explained ↗
- 10 Real Life Insider Threat Examples ↗
- Insider Threat Detection and Behavioral Analytics ↗
- Insider Risk Management Is Not Surveillance ↗
- Insider Threat Awareness and Trusted Access ↗
- Insider Threat and Insider Risk Updates ↗
- Insider Threat News ↗
- Global Insider Threat Tracker Launch ↗
- National Insider Risk Symposium 2026: AI Insider Risk ↗
AI and Emerging Insider Risk
Explore how agent identities, delegated permissions, and AI enabled workflows can expand the insider risk surface.
AI Agent Insider Risk and Shadow Identity ↗Practical Program Tools
Apply the research through assessments, planning tools, and operational templates available on Cybersecurity Threat & AI.
Insider Risk Assessment ↗ Insider Incident Cost Estimator ↗ Insider Threat Program Charter Generator ↗Reference and Updates
Use the updates archive for ongoing coverage, and the glossary pages for foundational terminology.
Insider Threat Definition ↗ Insider Risk Explained ↗ Full Insider Threat and Insider Risk Updates Archive ↗Additional Insider Risk Resources by Source
Newsletters · Blog · Glossary · Knowledge PagesMore insider risk and insider threat material collected from the site’s LinkedIn Newsletter Backlinks, Blog, Glossary, and Knowledge Pages inventories. Gurucul Threat Entries and Gurucul authored material are excluded.
LinkedIn Newsletter Backlinks
- Trusted Access, Hidden Risk: Why Insider Threats Demand More Than Access Controls ↗
- The Insider Threat Problem No One Likes to Talk About ↗
- Claude Co-Work and the New Access Perimeter: Why AI Collaboration Redefines Insider Risk ↗
- When AI Becomes the Insider: Guarding Against Rogue Models ↗
Blog
Glossary and Foundational Terms
- Access Control ↗
- Access Management ↗
- Behavioral Analytics ↗
- Compromised Credentials ↗
- Compliance ↗
- Cyber Risk ↗
- Data Exfiltration ↗
- Data Loss Prevention (DLP) ↗
- Digital Identity ↗
- Authentication ↗
- Authorization ↗
- Asset Inventory ↗
- Bring Your Own Device (BYOD) ↗
- Biometric Authentication ↗
- Challenge Response Authentication ↗
Knowledge Pages: Insider Risk and Insider Threat
- 10 Real Life Insider Threat Examples ↗
- AI Agent Insider Risk and Shadow Identity ↗
- Insider Risk Explained ↗
- Insider Risk Management Is Not Surveillance ↗
- Insider Threat Awareness Month and Trusted Access ↗
- Insider Threat Detection and Behavioral Analytics ↗
- Insider Threat and Insider Risk Updates ↗
- Insider Threat News ↗
- Insider Risk Intelligence Hub ↗
- User and Entity Behavior Analytics (UEBA) Guide ↗
Knowledge Pages: Governance and Program Readiness
Insider Risk & Insider Threat Glossary
Reference pagesStart with the core definitions and follow the linked reference pages for more detail.
Core Definitions
- Insider Threat↗
- A risk arising when someone with authorized access may use that access in a way that harms an organization, its people, or its information.
- Insider Risk↗
- The broader exposure created by malicious actions, mistakes, compromised accounts, and misuse of legitimate access.
- Behavioral Analytics↗
- Analysis of activity patterns and context to help identify behavior that may require investigation.
Governance and Access
- Privacy Aware Insider Risk Management↗
- A risk management approach that considers proportionality, privacy, governance, and legitimate business needs.
- AI Agent Identity Risk↗
- Risk that arises when AI agents use identities, credentials, permissions, or tools without clear ownership and oversight.
- Trusted Access↗
- Authorized access that still requires appropriate review, context, and accountability.
Editorial Standards
LiveSourcing
Every newsroom and archive entry is checked individually for a genuine insider-origin angle — a malicious, negligent, departing, or third-party insider at the center of it — before publication. General breaches, malware, and vendor CVEs with no insider angle are excluded by design.
Facts, allegations, and findings
Coverage distinguishes confirmed facts from allegations, company statements, law-enforcement findings, and expert interpretation. Where a source is uncertain, the item is left out rather than published with an invented attribution.
Privacy by design
Interactive tools will use privacy-conscious, proportionality-aware language throughout, and the program’s editorial position is that insider risk is a people, data, identity, and governance problem — not only a monitoring one.
