SentinelOne puts annual insider threat costs at $19.5m

What happened

Cybersecurity company SentinelOne has put annual insider incident costs at $19.5m per organisation in an online statistical overview updated on 6 May 2026.

The company, which published the 2026 insider threat overview, identifies negligence, misuse of legitimate access and unauthorised artificial intelligence tools as significant sources of exposure. Its definition extends beyond employees deliberately stealing information to include mistakes and accounts taken over by outside attackers.

SentinelOne says the figures combine breach disclosures, law-enforcement information, independent research and enterprise surveys published through early 2026. The article is a compilation rather than a single newly presented study, and also promotes the company's security products.

The supplied text does not give study-level references, sample sizes or methods for most figures. Several sections also present different estimates for incident frequency, costs and containment times without fully explaining whether they cover different populations or definitions.

For example, one section puts incident frequency at roughly two a month, while another describes approximately six. The article calls the $19.5m annual cost a 20% increase over two years in one passage, but uses 2023 as the comparison point elsewhere. Those differences limit its usefulness as a precise benchmark for an individual organisation.

The background

An insider risk arises when trusted access to systems or information creates an opportunity for harm. An employee may deliberately misuse that access, expose a file accidentally or lose control of an account after being deceived by an attacker.

SentinelOne attributes about 55% to 56% of incidents to negligence, including phishing mistakes, lost work devices and incorrectly configured databases. It separately cites research putting non-malicious activity at about 75% of tracked events when people deceived by external attackers are included. Those categories are not interchangeable.

Contractors and business partners also fall within the article's scope. It places their share of insider threats at 15% to 25% worldwide, while separately citing studies in which third parties with excessive access account for about 34% of incidents. The overview does not establish a common basis for comparing those estimates.

The wider issue is that a valid login does not establish whether an action is safe. Someone using an authorised account may be carrying out normal duties, exceeding their responsibilities or acting under an attacker's control. That distinction helps explain the emphasis on account activity and file movements in Mimecast's guidance on data exposure.

AI adds another route through which trusted access can expose information. The overview describes employees entering internal documents into public AI services and organisations giving AI tools extensive access to cloud applications. It uses the term shadow AI for tools used without organisational approval or oversight.

The exposure varies by sector. SentinelOne links technology businesses to risks involving source code and digital access credentials, healthcare to access to patient records, and financial services to fraud and commercially sensitive information. In manufacturing, the material at risk includes designs, formulas and trade secrets.

Organisation size affects the capacity to respond as well as the amount of access to supervise. The publisher says mid-sized businesses may lack dedicated investigation teams, while smaller employers can concentrate payment authority, supplier administration and customer information in a single role.

What people are saying

SentinelOne says 73% of security leaders are concerned about unauthorised AI access and 23% of employees use unapproved AI tools despite company bans. It also reports that 53% of companies give AI tools full access to cloud, productivity and collaboration services.

The publisher reports that 93% of security leaders regard insider incidents as more difficult to detect than external attacks. It attributes investigation delays to excessive alerts, difficult-to-interpret activity records and security tools that do not share information effectively.

On remote working, SentinelOne says 72% of organisations lack a complete view of how staff handle sensitive data across devices and cloud software. It identifies home networks, shared devices and informal working practices as additional routes for exposure.

Its cost estimates differ substantially by employer size. The article puts annual spending to address insider incidents at $24.6m for organisations with more than 75,000 employees, compared with $8m for those employing fewer than 500 people.

The company says financial services has the highest average annual insider-related cost, at $20.68m. It separately gives a healthcare breach cost of up to $12.6m per incident; that is a different measure from an annual organisational total.

SentinelOne also reports that 65% of organisations with dedicated insider-risk programmes said those programmes were the only control to identify a potential breach early. Its guidance favours examining behaviour alongside account permissions rather than relying on evidence of malicious software alone.

What happens next

The article sets out security priorities rather than a scheduled policy change or enforcement action. Its recommendations centre on tighter management of identities, more limited access and monitoring that connects activity across accounts, devices and cloud services.

One proposed control is just-in-time access: giving someone elevated permissions for the period in which they need them, rather than leaving those permissions permanently available. Continuous authentication, another approach discussed in the overview, checks access on an ongoing basis rather than relying solely on an initial login.

The publisher also discusses tools that detect unusual behaviour and tools intended to prevent sensitive information leaving approved systems. Their respective roles are to identify departures from normal activity and flag or restrict risky transfers, including uploads, downloads and email forwarding.

For AI, the oversight question extends beyond which applications employees use to what information automated tools can reach. This broader treatment of trusted systems is also reflected in DTEX's guidance on including AI in insider-risk management.

Organisations using the overview for budgeting would need to distinguish annual losses from individual breach costs and identify which research matches their sector and size. The article's differing containment measures—67 days in one section, 70 to 80 days elsewhere and a 241-day compromise-to-containment lifecycle—also require clarification before they can support like-for-like performance comparisons.