The Insider Threat Is Growing, What Does This Mean for your Organisation?
For a long time, cyber security was built around a simple idea: keep the bad actors out. Firewalls, endpoint protection, email filtering and perimeter controls all assumed that if someone got through, they must be an attacker.
However research points to a different reality. Increasingly, the risk isn’t someone breaking in, it’s someone already inside. For organisations, that changes the nature of cyber security in practical and uncomfortable ways.
The Reality Of Human Risk
According to Mimecast’s State of Human Risk Report, which included 250 Australian respondents, organisations globally are dealing with an average of six insider‑related incidents per month, with the average cost of each incident exceeding $13 million.
The outlook is also worsening. Around 66% of organisations expect insider‑driven data loss to increase and 42% of insider incidents are now malicious rather than accidental.
“This shift is important to recognise. Insider risk was once dominated by mistakes like misdirected emails, weak passwords, files shared too broadly. Those risks still exist, but they’re no longer the full picture. Intentional misuse of access is now just as common”, noted Gavin Hall, Business Technology Consultant at Diamond IT.
Data from a recent report How AI and the Analytics Gap Are Fueling Insider Risk reveals 34% of Australian organisations identify malicious insiders as the greatest threat today, eclipsing the 24% of respondents citing compromised insiders. While 42% still view external threat actors as the primary risk, the combined 58% concerned about insider threats signals a fundamental shift in the current risk landscape.
Why Insider Risk Is Rising Now
The shift in today’s risk landscape reflects a clear change in attacker behaviour. Threat actors are moving away from breaching systems and are instead exploiting legitimate access to reach sensitive data.
Stolen credentials, compromised accounts and insiders (willing or otherwise) allow attackers to move through environments without triggering traditional alarms because the activity looks normal in system logs.
Brian Dabit, Managing Director at Accenture Security, describes this as a fundamental shift. The industry is now dealing with coerced insiders, individuals pressured or manipulated into misusing their access, not just malicious employees.
This trend is not static, it’s accelerating. Data from How AI and the Analytics Gap Are Fueling Insider Risk shows that 62% of Australian organisations feel that insider threats have increased in the past twelve months. This growth reflects a broader change in how threat actors operate, they’re now shifting focus away from technical compromise and toward people within the organisation.
“Threat actors are deliberately targeting people rather than infrastructure, focusing on roles with proximity to data, systems and privileged access,” warns Gavin Hall.
What This Says About Modern Cyber Security
Insider risk has grown alongside the way modern IT environments are designed. Cloud‑first, highly collaborative, and accessible from anywhere.
At the same time, access permissions accumulate, visibility is reduced in hybrid environments and trust‑based access models remain common. With AI and automation in play, a single user can now move or expose far more data than was possible a few years ago.
The challenge for organisations is not productivity but visibility. Activity that looks normal in logs may still represent risk, making misuse of legitimate access harder to detect.
This points to a simple conclusion: traditional security investment hasn’t failed, but it’s incomplete. Perimeter controls remain important, but they are not designed to detect misuse of legitimate access.
When insider incidents occur, detection often comes late and in worst cases, only after the damage is done.
Responding to the Shift
Insider threats, just like any other cyber security risk, will continue to evolve. An effective response doesn’t mean ripping out existing controls, but it requires adjusting your focus on addressing emerging risks as they evolve and closing visibility gaps.
In most cases, risk builds quietly through excessive or outdated access, limited visibility into how systems are actually used and gaps between departments. Start by tightening access governance particularly for sensitive data, shared environments and privileged accounts as well as ensure there’s a clear understanding of what “normal” activity looks like across key roles.
From there, focus on visibility and coordination. It’s not enough to know who logged in. Organisations need a baseline for how data is typically accessed and used so abnormal behaviour can be identified early. At the same time, insider risk should be treated as a shared responsibility, aligning lifecycle processes, expectations, and response pathways across teams.
The goal isn’t to immediately eliminate risk entirely, but to reduce exposure and respond faster and more effectively when something doesn’t look right.
How Diamond IT Can Help
Insider risk is ultimately a visibility and behaviour challenge. Diamond IT helps organisations identify where access, data use and day‑to‑day behaviour introduce risk through Cyber Risk Discovery, surfacing exposure and gaps before they become incidents. Supported by Cyber Security Awareness Training, we can help you focus on real‑world scenarios and data responsibility, helping teams understand how everyday actions can carry unintended risk.
If you’re looking to better understand your current exposure or want to talk through where to start, get in touch by calling 1300 307 907, sending an email to enquiries@diamondit.com.au or filling out the form below.
