Insider risk: why trusted access is a strategic business risk

Ransomware, AI-enabled attacks, third-party risks and geopolitical instability are constantly testing the limits of organisations' cyber resilience. However, a strong focus on external threats can lead to risks associated with trusted access, such as access for employees, freelancers, suppliers and partners, receiving insufficient attention. PwC experts Mimoent Haddouti, Peter Avamale and Sachi Chakrabarty examine the concept of 'insider risk' in greater depth.

When strengthening their cybersecurity, organisations primarily look outward, beyond their own 'fence'. Recent PwC research shows that Dutch organisations are increasingly looking at third-party and supply chain risks in cybersecurity. However, exploiting or influencing someone with legitimate access is often much easier than breaking through perimeter security.

Geopolitical tensions, financial pressure, coercion, blackmail and ideological motives can increase the likelihood of people being manipulated or persuaded to act against an organisation's interests. At the same time, well-intentioned employees can cause risks through mistakes, overly broad access rights, unsafe behaviour or workarounds that bypass cumbersome processes.

This makes insider risk much more than just a cybersecurity issue. It is a strategic business risk with consequences for resilience, reputation, intellectual property, compliance with laws and regulations, operational continuity and trust. Effective risk management requires an integrated approach from cybersecurity, HR, Legal, Compliance, Risk, physical security and the board, bringing people, processes and governance together.

Insider risk goes beyond malicious intent

Insider risk is often associated with a 'disgruntled employee' who deliberately causes damage. In practice, the risk is much broader and more nuanced, encompassing a spectrum of intentions, behaviour and organisational circumstances.

Internal risk profiles and associated control measures

Note: not everyone who causes risk is a malicious actor. The response must take into account intent, access, behaviour and context.

Each internal risk profile requires a different approach. Malicious activities require formal investigation, incident containment and disciplinary or legal measures. With careless or unintentional actions, you may need to review processes, improve training, remove bottlenecks and strengthen preventive controls.

The key challenge for executives is not to treat every internal risk as misconduct. Not everyone who causes risk is a malicious actor. Effective insider risk management requires insight into intent, access, behaviour and context, followed by a proportionate and legally sound response that aligns with business objectives.

Why traditional security measures are not sufficient

Traditional cybersecurity measures largely focus on preventing unauthorised access and detecting external attacks. Insider risk challenges that approach. After all, the person causing the risk may already have legitimate access, a trusted role and a valid business reason to work with sensitive systems or data.

An employee may have access to confidential information but choose to misuse it. An external employee may need elevated access rights to support a critical platform, thereby gaining the ability to expose or manipulate data or systems. At the same time, former employees, suppliers or service accounts sometimes retain access if offboarding, credential management or system integrations are inadequately controlled. As operational models become more distributed, this creates a fundamentally different control challenge that cannot be solved with perimeter security alone.

Context is crucial here. A single unusual login or file download may have a legitimate explanation. However, a sequence of activities may reveal a more concerning pattern. For example, an employee may access digital archives that fall outside normal responsibilities, create an archive of sensitive files and upload it to personal cloud storage. Assessed individually, these events may not trigger an alert. Taken together, however, they may indicate data theft.

Effective insider risk management therefore begins with understanding the risks your organisation faces and assessing whether existing control measures are adequate to counter them. This makes gaps visible and allows you to determine where action is needed.

It is not possible to effectively manage insider risk with separate control measures alone. As organisations, you must be able to connect information about identity, access, behaviour and business context to form a single coherent picture. The starting point is a clear assessment of the organisation's specific internal risks and the effectiveness of existing control measures. This allows you to deploy investments in a targeted manner and strengthen your organisation's resilience without adding unnecessary complexity or overlap.

A coordinated approach across the entire organisation

Insider risk sits at the intersection of cybersecurity, personnel management, legal obligations, operational resilience and organisational culture.

IT and information security teams play an important role in identifying suspicious activities, managing access and investigating technical incidents. HR can provide insights from personnel processes and workplace behaviour. The legal department, risk management and compliance help ensure that investigations and monitoring comply with applicable requirements. You should also involve privacy professionals and employee representatives where relevant, particularly if measures have implications for employee privacy or require consultation.

Clear governance is essential for cyber incidents

Clear governance is essential. As an organisation, you must clearly assign ownership, establish responsibilities and agree on incident escalation procedures. It is also important to assess existing control measures before investing in new technology, so that you address gaps efficiently and prevent operational overlap.

Managing risks throughout the entire employee lifecycle

Insider risk management should be part of your complete employee lifecycle: from recruitment and daily work to changes in roles or circumstances and ultimately departure. Similar principles apply to external employees and other third parties.

• Onboarding: apply proportionate, legally permitted screening and grant only necessary access rights. Make expectations about information security and safe behaviour clear.
• Daily work: combine access controls, training and risk-based proportionate monitoring to recognise deviations in context. Make safe working easy by having workable processes, clear rules and accessible reporting channels.
• Changes in role or circumstances: reassess access rights and remove superfluous rights. Carefully consider relevant circumstances, without making assumptions about individuals and while protecting sensitive personal data in accordance with the law.
• Offboarding: withdraw digital and physical access, including login credentials and tokens, in a timely manner and have company assets returned. Only pay additional attention to activities during the notice period where necessary, with appropriate HR, legal and privacy safeguards.

Start with the risks that matter most

You do not need to address all conceivable risk scenarios simultaneously. Prioritise the risks that can cause the greatest damage and focus on a manageable number of realistic scenarios.

Insider risk is a growing business risk and not just a technical problem. Trusted access does not mean risk-free access. By proactively identifying the main risks, assessing existing control measures and bringing together governance, people, processes and technology, organisations can strengthen their cyber resilience and protect the trust on which their operations are based.