Insider threats: the risk within.
Cybersecurity risks can come from people who already have access to an organisation’s information and systems. Whether caused by an honest mistake, an unsafe shortcut or deliberate misuse, insider threats can expose sensitive information and damage trust.
This month we look at how those consequences go beyond the immediate financial cost, why keeping your credentials private reduces insider risk, and which actions deserve attention. By protecting your access, following approved procedures and reporting concerns promptly, you help safeguard your organisation.
The short version
- Insider threats can be honest mistakes, unsafe shortcuts or deliberate misuse.
- The cost goes beyond money: disrupted work, exposed information and lost trust.
- Never share your login. Use approved delegation and sharing features instead.
- Open payroll portals from your approved link or a verified bookmark, never a search ad.
The cost of insider threats.
These situations have different intentions, but each can put an organisation at risk.
A sensitive file sent to the wrong person. A colleague using someone else’s login. An employee deliberately taking confidential information. Whatever the intention, the costs add up in several ways.
Where the costs add up
Response and recovery
Investigating an incident takes time and resources. Organisations may need to identify what happened, secure accounts, restore information and bring in outside specialists.
Interrupted operations
Deleted files, unauthorised changes or compromised systems can disrupt everyday work. Employees may lose access to essential tools, projects may stall, and customers may experience delays.
Exposed information
Customer records, employee information, financial details and confidential business plans can be compromised. Once information has been copied or disclosed, recovering a file doesn’t undo the exposure.
Damaged trust
Customers and business partners expect organisations to protect their information. An incident can weaken that confidence and affect relationships long after the immediate problem is resolved.
Additional obligations
Depending on the incident and applicable requirements, organisations may face notification expenses, legal claims or regulatory consequences.
Your login, your responsibility.
“Can I use your login for a minute?” It may sound like a small favour, especially when a colleague is facing a deadline.
But sharing your credentials can give someone access to information or actions they haven’t been approved to use.
Credentials include passwords, PINs, and other information or tools used to access an account. Protecting them matters even when the person asking is someone you know.
How sharing creates unintentional risk
Imagine lending your account to a colleague who can’t access a system. While completing their task, they accidentally change a record or open information outside their role. Neither person intended to cause harm, but sharing the account bypassed the organisation’s access controls and created an opportunity for a mistake.
How sharing enables intentional misuse
Someone seeking to steal information or make unauthorised changes could ask to borrow another person’s account, which might provide access their own account doesn’t. Activity may initially appear under the account owner’s name, making it harder to work out who actually performed an action.
Trusting a colleague doesn’t replace the need for individual, authorised access.
Help without handing over access
- Keep your individual password and PIN private.
- Protect your sign-in factors.
- Use approved delegation and sharing features.
- Lock your screen when you step away.
- Direct access problems to IT or the approved support team.
Recognise the risk.
Insider threats don’t have one recognisable personality or appearance.
The most useful warning signs involve how someone handles information, uses access or follows security procedures.
Understanding the difference between unintentional risk and possible deliberate misuse can help you recognise concerns when you see them.
Unintentional: harm without malicious intent
An honest mistake, a misunderstanding, or a shortcut taken without intending harm. Someone may knowingly skip a security step without recognising the consequences.
- Sending sensitive information to the wrong recipient
- Giving a file broader sharing permissions than intended
- Leaving a device unlocked or confidential paperwork exposed
- Using an unapproved personal account or application to complete work
- Sharing credentials to help a colleague finish a task
Intentional: possible signs of deliberate misuse
Someone deliberately uses their access to steal information, disrupt operations or otherwise cause harm, perhaps for financial gain, revenge, or under pressure from someone outside the organisation.
- Trying to access sensitive information unrelated to assigned work
- Copying or transferring confidential files to an unauthorised destination
- Asking to use another employee’s account to bypass an access restriction
- Disabling security protections or trying to erase activity records without authorisation
- Deliberately altering, deleting or disclosing information without permission
Fake payroll portal scams.
Each month we highlight a scam that shows tactics criminals are using right now, so you’re better prepared when the next one hits.
A quick search
Alex wants to check his latest payslip. Instead of using the link on his company’s employee resource page, he searches online for the payroll provider. A sponsored result appears near the top, and the name looks right.
A familiar login page
He clicks it and lands on a page with the familiar logo, colours and login form. Nothing seems out of place, so he enters his username and password. When the page shows an error, Alex assumes the service is temporarily unavailable and decides to try again later.
The page was a copy
The website was a convincing copy created by criminals, and the error message hid the fact that it had captured his credentials. If the attackers get into the real payroll portal, they could change his bank details and send his future pay to an account they control.
Did you spot the red flags?
How to protect yourself
Use your organisation’s approved link or a verified bookmark. Access payroll and benefits portals through a trusted route instead of a search advertisement.
Report suspected exposure immediately. If you entered credentials on a suspicious page, contact your approved IT support team so IT and payroll can act before money goes missing.
Your two-minute security check.
Tick what you’ve already done this month.
Insider Threats: The Risk Within
Understanding the impact, protecting your credentials and recognising warning signs.
Turn the page to start.
The risk that’s already inside.
- The cost of insider threats
- Your login, your responsibility
- Recognise the risk
- Scam of the month: fake payroll portals
The cost of insider threats.
A file sent to the wrong person, a borrowed login, or confidential information taken on purpose. Different intentions, but each puts the organisation at risk.
The costs add up through response and recovery, interrupted operations, exposed information, damaged trust and additional obligations.
Your login, your responsibility.
“Can I use your login for a minute?” sounds like a small favour, but it bypasses the organisation’s access controls.
Shared accounts create room for mistakes and misuse, and activity appears under the owner’s name.
Recognise the risk.
Warning signs are about how someone handles information, uses access or follows procedures, not how they look.
Unintentional: misdirected emails, oversharing, unlocked devices. Intentional: accessing unrelated data, copying files out, disabling protections.
Fake payroll portal scams.
Alex searches for his payroll provider, clicks a sponsored result and logs in to what looks like the real portal.
It’s a copy. His credentials are captured, and his future pay could be redirected to the attackers.
Three things to remember.
- Your login is yours alone
- Report unsafe actions early
- Approved links, never search ads
Stay safe out there.
Spotted something suspicious? Report it through your organisation’s approved process.