Mimecast guidance puts data exposure at centre of insider risk

What happened

Mimecast published guidance on its website on 23 January 2025 urging organisations to assess insider risk through data exposure, rather than focusing only on people suspected of malicious behaviour.

The article, published by the Mimecast Cyber Insights Blog Team, sets out the company’s own definition of insider risk. It covers exposure that could harm an organisation, its employees, customers or partners, irrespective of the user’s intention or the data’s perceived value.

Mimecast says the material originally appeared on Code42’s website and was made available on its own site following its acquisition of that company. The publication is explanatory guidance, not a report of a particular breach, arrest or court case.

Its central recommendation is to examine three things together: the files involved, how and where they move, and the person or account moving them. The company calls this the File-Vector-User approach, with “vector” referring to the route or method by which data travels.

The background

Employees need access to organisational information to carry out their work. That creates a practical difficulty for security teams: the same access that supports routine tasks can also enable information to be exposed or removed.

Mimecast presents insider risk as a broader concept than insider threat. In its account, threat management concentrates on identifying malicious users, while risk management considers activities that endanger data even when there is no deliberate attempt to cause harm. The article acknowledges that insider risk does not have a widely established definition.

This distinction also appears in DTEX’s guidance on intent and insider risk, which separates accidental exposure from deliberate harm. Such terminology affects the scope of a security programme: a focus on intention alone may exclude mistakes from the activity being examined.

The challenge extends to accounts used by someone other than their legitimate holder. Microsoft’s insider risk guidance addresses compromised accounts alongside accidental exposure and deliberate misuse, while also considering employee privacy.

Mimecast’s article cites annual data exposure research surveying 700 business leaders, security leaders and practitioners at US companies. Alongside a link to its 2022 report, it presents figures saying insiders are involved in 60% of breaches and 96% of companies encounter difficulties protecting corporate data from insider risks.

Those figures should not be read as newly collected January 2025 findings. The supplied article does not give the survey’s fieldwork dates or detailed question wording, limiting what readers can infer about the measures and their wider applicability.

What people are saying

Mimecast argues that concentrating on apparently malicious employees can leave negligent behaviour overlooked. It says examining activities that expose information allows organisations to respond without first establishing why a person acted.

For the file element of its framework, the company recommends identifying information whose exposure could damage the business or disrupt operations. This helps security teams narrow their attention rather than treating every file as equally important.

For data movement, Mimecast says routine transfers must be distinguished from unusual ones. For the user element, it stresses the importance of job responsibilities: deleting part of a database could be expected activity for a database administrator but concerning when performed by someone in finance.

The guidance describes four examples of insider risk indicators — unusual activity that may signal a problem. These are prompts for examination, rather than findings that an employee has acted maliciously.

• Access outside usual working hours: Mimecast says activity departing from an employee’s normal schedule could indicate concealed downloads or an account that has been compromised.
• Access around an employee’s departure: The company identifies file access by departing or dismissed employees as a possible warning sign because information may be taken when employment ends.
• File contents that do not match the extension: Mimecast says a mismatch between a file’s contents and its filename ending may indicate an attempt to get around controls that block particular file types.
• Transfers to unapproved destinations: The guidance identifies movement to external locations, including a personal cloud drive, as a potential risk requiring attention.

Mimecast also says assessing every file and action individually is not workable at scale. It presents these indicators as a way to separate potentially significant activity from the much larger volume of ordinary business operations.

What happens next

The article sets out no implementation timetable or forthcoming regulatory requirement. Its recommendations are intended for organisations developing or reviewing how they detect data exposure.

Applying the framework requires organisations to establish which information matters most, what routes it normally takes and what activity is expected for different roles. Without that context, an unusual action is harder to distinguish from a legitimate task.

The guidance leaves some operational questions unanswered, including how long monitoring records should be retained, who should review alerts and what threshold should trigger an investigation. It therefore provides a starting framework for detection rather than a complete procedure for handling suspected incidents.