Insider Risk: What the Research Tells Us About Triggers and Timeframes
Most of it is mundane: a misdirected email, a file saved to a personal cloud account, a shortcut taken to meet a deadline. A smaller part is deliberate. The research shows that both ends of that scale tend to leave early warning signs in the way data is handled, and that those signs can be detected if you know what to look for.
In this blog, we'll look at what insider risk is, the evidence on the types of incident, the timeframes in which they occur and the events that tend to trigger them. We’ll also look at, and how Data Loss Prevention (DLP) and Insider Risk Management in products such as Microsoft Purview can turn that evidence into practical detection.
What Is Insider Risk?
Insider risk is the risk that someone with legitimate access to your systems, data or premises, such as an employee, contractor or supplier, causes harm to your organisation, whether deliberately or not. The UK's National Protective Security Authority (NPSA) puts it simply: if you have people, you have insider risk. Paul Martin, in Insider Risk and Personnel Security, describes insiders as people who betray trust by behaving in potentially harmful ways.
It helps to think of insider risk as a sliding scale rather than two separate categories. At one end is the negligent insider, who doesn't intend any harm: someone who emails customer data to the wrong recipient, shares a file more widely than they should or pastes sensitive content into an unapproved AI tool.
Next are people who knowingly bend the rules for convenience, such as moving files to a personal account so they can work from home. Further along are compromised insiders, whose accounts are being used by someone else, or who have been pressured or paid by an outside party. At the far end is the malicious insider, who deliberately steals data, sabotages systems or commits fraud. Where an incident sits on that scale determines the right response, which might be a reminder, a conversation or an investigation.
Behind any of these incidents there is rarely a single cause. Stress, a difficult relationship with a manager, a performance process, a job offer, financial pressure, a poorly designed process or a simple lack of awareness can all play a part, often in combination. The research we cover below describes risk building up over time rather than appearing overnight.
That is the useful part for security and privacy teams. Whatever the mix of factors, the person usually has to do something with data before harm occurs, and those actions tend to be visible: unusual downloads, files copied to personal cloud storage, sensitive documents sent outside the organisation, sharing that doesn't fit normal patterns. Martin's view is that personnel security should aim to detect the weak early signals of potential insider risk and stop it developing into full-blown insider behaviour.
This is where DLP and Insider Risk Management come in. DLP policies identify sensitive data and control how it moves, which addresses much of the accidental and careless end of the scale. Microsoft Purview Insider Risk Management adds context by correlating signals such as data movement, HR events and security alerts, and scoring users whose behaviour has changed, which helps at the deliberate end. Used together, they can detect early warning signs and support a proportionate response, whether that is a policy tip, a conversation, restricted access or a formal investigation.
Types of Insider Risk
The Ponemon Institute's 2026 Cost of Insider Risks Global Report gives a clear view of where incidents sit on that scale, grouping them into three types.
| Type of Insider | Share of Incidents | Average incidents per organisation a year | Average cost per incident |
| Negligent employee or contractor | 53% | 13.8 | $747,107 |
| Malicious or criminal insider | 27% | 6.3 | $742,125 |
| Credential theft (an outsider using a legitimate account) | 20% | 5.3 | $842,462 |
The average annual cost across all three was $19.5 million per organisation, from an average of around 25 incidents. Negligence made up $10.3 million of that, malicious activity $4.7 million and credential theft $4.5 million. Because the cost of each incident is similar, the frequency of negligent incidents is what drives the total.
Verizon's 2026 Data Breach Investigations Report (DBIR) gives a wider view across all breaches. Internal actors were involved in 12% of breaches. Looking at breach patterns, miscellaneous errors accounted for 8% and privilege misuse for 3%, down from 12% and 7% the year before. Furthermore, the 2025 DBIR found that 29% of breaches in EMEA originated internally, with 19% down to unintentional mistakes and 8% to misuse. Where insiders did misuse access, SpyCloud's summary of the 2026 DBIR reports that convenience was the most common motive (60%), ahead of financial gain (33%).
For deliberate activity, DTEX's investigations team reported that, of the insider cases it investigated, 43% involved IP or data theft, 24% unauthorised or accidental disclosure, 17% sabotage and 9% fraud. IBM's 2025 Cost of a Data Breach Report found that malicious insider attacks were the most expensive initial attack vector, at an average of $4.92 million per breach.
The practical point is that most insider incidents are not malicious, and that should shape how your controls are designed. Stopping someone emailing a spreadsheet to the wrong recipient is a different job to investigating deliberate theft, and your processes need to be able to tell the two apart.
Timeframes: When Does Insider Risk Increase?
For deliberate data theft, the research agrees on one thing: it is concentrated around the point someone leaves. The detail varies depending on the study.
Before Notice Is Given
Netskope analysed more than 58,000 leavers and found that 15% moved data from corporate systems to personal cloud applications. Most of that activity happened before employees would typically give notice, starting around 50 days before they left. Cyberhaven's analysis of 1.4 million workers found a similar pattern, with exfiltration incidents up 83.1% against baseline in the two weeks before notice was given, and 68.7% of the increase occurring before the employer had been told.
The Notice Period
CERT, part of Carnegie Mellon's Software Engineering Institute, analysed more than 600 insider cases and found that most insiders who stole intellectual property (around 70%) did so within 30 days of announcing their resignation. Many had already decided where they were going: Shaw and Stock's research for Symantec found that around 65% of IP thieves had accepted a position with a competitor, or started their own business, by the time of the theft.
Self-reported figures point the same way. Tessian's survey found that 29% of employees admitted taking data with them when they left a job, with marketing (63%), HR (37%) and IT (37%) the functions most likely to report doing so.
Dismissal
Cyberhaven also looked at employees who were dismissed. They were 23.1% more likely than baseline to exfiltrate data the day before and 109.3% more likely on the day itself, which suggests that some people sense a dismissal coming and others take what they can before their access is removed.
Planning and Detection
Insider actions are rarely spontaneous. The US Secret Service and CERT's Insider Threat Study found that 76% of insiders in the IT sector planned their activity in advance, and 88% in the government sector.
Detection, meanwhile, is slow. Ponemon found an average of 67 days to contain an insider incident, with only 13% contained within 30 days. The difference matters financially: organisations whose incidents were contained within 30 days reported annualised costs of $14.2 million, against $21.9 million where containment took more than 90 days.
Paul Martin makes a related point about measurement in Insider Risk and Personnel Security. The number of known insider cases in an organisation is a poor metric of insider risk, because the absence of known cases is not evidence that the risk is absent. In practice, a low number of reported cases may simply reflect limited visibility.
Taken together, the studies suggest that the risk window opens roughly seven weeks before someone leaves, and that a meaningful share of activity takes place before HR or the line manager is aware. The studies differ in method and sample, so the exact numbers shouldn't be over-interpreted, but the direction is consistent. It also means that a policy which only starts monitoring when a resignation date is recorded will, by design, miss part of the picture.
Triggers and Stressors Beyond Resignation
A resignation is the most visible trigger, but it is not the only one, and the research suggests it is often a symptom rather than a cause. The Secret Service and CERT study of insiders in the IT sector found that a specific work-related event triggered 73% of the insiders' actions, and that 63% held technical positions. CERT's separate research on IT sabotage found that it is typically carried out by technical users with privileged access, such as system administrators and developers, and that the usual motive is revenge for a negative workplace event.
The CERT Guide to Insider Threats, written by the CERT team behind much of this research, draws on more than 700 insider cases collected since 2001 and groups them into IT sabotage, IP theft and fraud. The patterns differ in ways that matter for policy design. Dawn Cappelli has said that many sabotage cases happen after the person has been terminated, and that in none of them was the person seen as someone who would never have done such a thing. IP theft tends to follow two patterns, described in one review as the 'entitled independent', who feels ownership of work they contributed to, and the 'ambitious leader', often with a trigger such as dissatisfaction or a job offer from a competitor. Fraud, by contrast, is typically carried out by people who stay with the employer, often over a long period.
That means a departing-user policy addresses IP theft well, but fraud and sabotage need different signals. Cappelli's own summary is that these crimes can't be detected with technology alone, because an administrator using their access is doing what they do every day, unless you know when to look. That is the argument for connecting HR events to your technical controls.
Eric Shaw's Critical Pathway to Insider Risk, built from analysis of real insider cases, describes how personal, professional and financial stressors can push someone who already has certain vulnerabilities towards harmful behaviour, and how an inadequate organisational response can accelerate that. Typical professional stressors include being placed on a performance improvement plan, receiving a poor review or being demoted. Shaw and Stock also found that professional setbacks often precede IP theft, although being disgruntled does not by itself mean someone will steal.
Culture and Organisational Factors
The UK's CPNI (now NPSA) found clear links between insider acts and organisational weaknesses, including poor management processes, auditing, security culture and pre-employment screening. Paul Martin's Insider Risk and Personnel Security (2024) lists similar factors thought to increase insider risk, including unethical leadership, incompetent management, injustice, feeling undervalued, interpersonal conflict, chronic stress, job insecurity, excessive work demands and impending job loss, as summarised by the Police Science Council's magazine. These are factors associated with risk in case studies rather than quantified predictors, and we did not find robust evidence that culture or engagement survey results can predict the behaviour of an individual. Used at team or business unit level, they can show where morale has dropped or where a change programme has landed badly, and so where extra support or controls may be needed.
Negligence, Convenience and AI
Given that 53% of incidents are negligent, everyday working practices deserve as much attention as disgruntlement. Ponemon found that the cost of negligent incidents rose 17% year on year, with shadow AI a driver. Verizon's research, which we covered in our recent blog on human error data breaches, found that 15% of employees regularly use generative AI tools on work devices, and that nearly three-quarters use their personal accounts.
Third Parties
This list isn't exhaustive. Third parties are a further factor, with the 2026 DBIR reporting third-party involvement in 48% of breaches, up from 30% the previous year. Contractors and suppliers sit outside many HR-driven triggers, such as resignations and performance reviews, so they need to be covered in other ways.
When the Pressure Comes From Outside
Not every insider acts on their own initiative. In May 2025, Coinbase disclosed that criminals had bribed overseas customer support agents to copy customer data, affecting 69,461 people. The activity began on 26 December 2024 and wasn't discovered until 11 May 2025, around 136 days later, when Coinbase received an extortion email. It estimated the cost at between $180 million and $400 million. Cyberint reported that in August 2025 the Scattered Lapsus$ Hunters group was recruiting insiders at several large organisations through Telegram. DTEX has also warned of a rise in 'socially engineered insiders', with state actors targeting, recruiting and planting insiders.
Credential theft makes up 20% of insider incidents and is the most expensive per incident. In both cases, the person involved may have no history of concerning behaviour. DTEX's investigations found that 64% of malicious IP theft cases involved some form of data preparation, aggregation or conversion, and that 95% of malicious insiders avoided techniques covered by MITRE ATT&CK. The activity tends to look like normal work, so the signals are in the data: how much is moving, where it is going and whether it fits the person's role.
Using the Evidence in Microsoft Purview
The research gives a reasonable guide to what to look for, and Purview Insider Risk Management's policy templates are built around many of the same scenarios.
The Data theft by departing users template is triggered by a resignation or termination date, imported from HR through the Microsoft 365 HR connector, or by account deletion in Microsoft Entra. It scores activity such as downloading files from SharePoint, printing and copying data to personal cloud storage. Until a date is reported, a user isn't evaluated by the policy. Given the pre-notice activity described above, it shouldn't be the only policy you rely on.
The Data leaks template scores real-time detections and can take high severity DLP alerts as a trigger, with cloud indicators for services such as Box, Dropbox, Google Drive and Amazon S3. Data leaks by priority users applies the same approach to defined groups, such as those with privileged access. Neither depends on an HR event.
The Data leaks by risky users and Security policy violations by risky users templates use HR data on performance improvement plans, poor performance reviews and job level changes, and can incorporate Communication Compliance signals. These map to the stressors described above. The Security policy violations templates use Microsoft Defender for Endpoint alerts, such as disabling security features or installing unwanted software, which is relevant given the sabotage research.
Adaptive Protection brings these together by assigning users an insider risk level (elevated, moderate or minor) and adjusting DLP and Conditional Access policies to match, so that tighter controls apply only to those whose risk has increased.
Pierre Skorich and Matthew Manning's Insider Threat: A Systemic Approach (2024), based on ten years of work across government departments and agencies, frames insider risk around an organisation's critical assets, the opportunity people have to reach them and their motivation, rather than around individuals alone. That is a useful starting point for a Purview design: classify the data that matters most first, then ask who has the opportunity to move it, and which signals would show that it is happening.
Getting the Balance Right
Insider risk monitoring involves processing employees' personal data, so it needs to be treated as a data protection project as well as a security one. The ICO's guidance on monitoring workers expects organisations to have a legitimate purpose, to tell workers about the nature, extent and reasons for monitoring, and to complete a Data Protection Impact Assessment (DPIA) where monitoring is likely to be high risk. Information gathered through monitoring can also fall within a subject access request. The ICO's own research found that 70% of people would find workplace monitoring intrusive.
Purview helps here. Users are pseudonymised by default, and role-based access controls and audit logs are in place. These features don't replace the work around them, which includes a DPIA, updated staff privacy notices and acceptable use policies, clear rules on who can see alerts, and defined retention periods.
Key Takeaways
- Don't wait for the resignation. Activity increases before notice is given, so keep DLP protection in place for critical data at all times, and look back over activity ahead of a leaver's notice date.
- Plan for negligence as well as malice. More than half of incidents are not deliberate, so education, policy tips and proportionate controls matter as much as investigation.
- Treat HR events as signals, with care. Performance management, demotion and dismissal are associated with increased risk, but they indicate a need for closer attention, not a conclusion about the individual.
- Cover third parties and compromised accounts. They sit outside the HR triggers, and credential theft is the costliest insider category per incident.
- Build privacy in from the start. Transparency and a DPIA make monitoring easier to defend and more likely to be accepted by staff.
How Bridewell Can Help
Bridewell supports organisations with the design and rollout of DLP and Insider Risk Management, from understanding which data matters and how your people use it, to policy design, HR integration, DPIAs and testing before go-live. If you want to discuss Microsoft Purview in more detail, or are interested in running a pilot project with support from Bridewell, please get in touch. For more on this topic, we also recommend our Preventing Data Loss with Microsoft Purview webinar.
Chris Linnell
Associate Director - Data Privacy
Blogs
Blogs
