Glossary
Insider Threat
An insider threat comes from a principal that already has legitimate access: an employee, a contractor, a partner's system. The risk does not require malice — carelessness or a compromised personal account can cause identical damage to a deliberate act — which is why defenses aimed only at keeping outsiders out leave this risk largely untouched.
The controls that limit insider risk are largely the same ones already discussed elsewhere: scoped, least-privilege access so no single legitimate identity can reach everything; separation of duties so no one person completes a sensitive action alone; and evidence good enough that unusual activity by a legitimate identity is still visible, not hidden behind the assumption that anything an authenticated insider does is fine by definition.