Insider risk survey finds low confidence in early detection

What happened

Only 23% of cybersecurity professionals surveyed in early 2025 expressed strong confidence in detecting insider threats before significant damage, according to a report published online by Cybersecurity Insiders in collaboration with Cogility.

The 2025 Insider Risk Report draws on responses from 635 chief information security officers and cybersecurity professionals. It found that 93% considered insider threats at least as difficult to detect as external cyberattacks: 43% regarded them as harder, while 50% saw them as equally difficult.

The findings describe respondents’ assessments of their organisations, rather than independently tested detection capabilities. The published article does not give a geographical breakdown, detailed sampling information or evidence measuring whether the proposed monitoring approach prevents incidents.

Preparedness extended beyond detection technology. Only 27% reported having a detailed insider threat response plan, compared with 40% who relied on a basic or informal plan and 29% who had no plan.

Respondents also reported exposure outside their organisations. Nearly half, 49%, said they had discovered insider-related credentials, intellectual property or internal communications on the dark web, including 10% who reported frequent discoveries. These are reported experiences, not a count of independently verified breaches.

Cybersecurity Insiders, the original publisher of the findings, argues for combining security records with information about employee behaviour and circumstances. It presents this approach as a way to identify developing risks rather than relying primarily on alerts about suspicious activity.

The background

Insider threats can involve deliberate misuse or accidental harm by people operating within their authorised access. This makes detection difficult: a legitimate login or permitted file download may not, by itself, establish whether an action is harmful.

Access levels were central to respondents’ assessments. IT administrators and engineers were identified as having substantial potential to create insider risk by 83%, followed by third-party vendors at 77%, executives at 64%, and finance or human resources personnel at 59%. These figures concern the potential consequences of access, not evidence that people in those roles are more likely to act maliciously.

Existing monitoring concentrated heavily on digital activity. Email and communications monitoring was reported by 74%, oversight of privileged users by 69%, and basic behavioural analytics by 61%. Such analytics look for patterns or departures from normal activity, but the publisher says they often lack information about the circumstances behind an action.

Only 21% said their organisations extensively incorporated behavioural information, such as human resources concerns or financial stress, into detection programmes. Another 26% reported moderate use, while 49% described minimal or no use.

The report’s proposed whole-person approach brings together technical activity and personal or workplace context. That could include employment disputes, financial pressures or legal concerns alongside changes in access and file activity. These circumstances are proposed risk indicators, not proof of misconduct.

The distinction between vulnerability and intent is important. A separate survey question asked respondents to estimate how employees might respond to hypothetical incentives and anonymity. The publisher explicitly says those responses reflect perceptions of susceptibility, not predictions that employees will commit wrongdoing.

This emphasis on context also appears in DTEX’s guidance distinguishing insider risk from deliberate threats. Its recommendations consider employee behaviour, workplace pressures and privacy when deciding how to respond.

Artificial intelligence adds another dimension to the survey. Sixty per cent expressed high concern about insiders misusing AI tools. Reported worries included deepfake-enabled phishing and social engineering at 69%, automated removal of data at 61%, and AI-assisted misuse of login credentials at 53%.

Those percentages measure concern, not the prevalence of successful AI-enabled attacks. Deepfakes are synthetic media that can impersonate people, while social engineering involves manipulating someone into disclosing information or taking an unsafe action.

What people are saying

Cybersecurity Insiders says many insider threat programmes remain fragmented and geared towards reacting to incidents. It argues that technical alerts can show what happened without adequately explaining why, making it harder to distinguish ordinary activity from a developing threat.

The publisher identifies inadequate tools, cited by 71%, budget constraints at 69%, and privacy or legal concerns at 58% as the main barriers to improving insider threat management generally.

A separate question about incorporating broader behavioural context produced a different ranking. Privacy and legal concerns were cited by 77%, difficulties connecting systems by 67%, technology limitations by 54%, and problems obtaining relevant behavioural information by 49%. These figures address that narrower integration challenge, rather than the overall programme barriers.

The report recommends privacy-preserving analysis informed by specialists, with methods that can explain how assessments are reached. It also calls for workflows connecting security, human resources and contextual information so that organisations can respond to emerging concerns before an incident.

On predictive assessment, the publisher reports that only 12% had a mature, operational model. Another 28% had early-stage or limited capabilities, while 56% either did not use predictive analytics or were only beginning to plan for them.

What happens next

The report sets out recommendations rather than a scheduled implementation programme. Its proposed direction is to combine multiple sources of information into assessments intended to identify risk earlier, but the supplied article gives no timetable for adoption or results from controlled evaluations of that approach.

For organisations considering broader monitoring, the unresolved issue is how to use sensitive information responsibly while establishing whether it improves detection. The survey does not show how accurately personal or workplace indicators predict harmful conduct, or how often they could wrongly identify someone as a concern.

Privacy is also a central consideration in Microsoft’s insider risk management guidance, which addresses accidental exposure, deliberate misuse and compromised accounts while balancing monitoring with employee privacy.

The findings leave organisations with two distinct areas to assess: whether they have clear arrangements for handling insider incidents, and whether additional data would improve their decisions. The survey documents reported gaps in preparedness; it does not establish that expanding employee monitoring alone will close them.