Loading story…
CISA has revised its Insider Threat Mitigation Guide with updated case studies, statistics, and resources to help security, HR, and organizational leaders build or assess insider-risk programs at any maturity level. The guidance addresses risks created by hybrid and remote work, adverse employee separations, and AI-enabled manipulation and deception, while broadening its scope from data protection to physical security, violence prevention, access control, and visitor screening.
The agency urges organizations to identify behavioral warning signs and improve preparedness and early-risk detection because trusted users, contractors, vendors, machine identities, and AI agents can misuse, compromise, or unintentionally expose organizational assets through otherwise legitimate credentials and workflows. Recommended measures include least-privilege and just-in-time access, identity and behavioral analytics, governance for non-human identities, adaptive controls for high-risk actions, data-loss prevention, and continuous security education.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
CISA published an updated Insider Threat Mitigation Guide with refreshed case studies and statistics and guidance addressing AI, hybrid and remote work, access control, visitor screening, and adverse employee separations. The revision expands the guide's scope to physical security and violence prevention alongside data protection and provides preparedness and early-risk-detection resources.
September 2026 is designated National Insider Threat Awareness Month, themed “Protect Our Potential,” promoting insider-risk awareness and mitigation programs across government and industry.
CISA first issued its Insider Threat Mitigation Guide.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
waterisac.org
Open sourcesecuritymagazine.com
Open sourceinfosecurity-magazine.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The 2025 Insider Risk Report, produced by Cybersecurity Insiders in collaboration with Cogility, reveals that a vast majority of organizations find insider threats as difficult or even more challenging to detect than external cyberattacks. According to the report, 93% of surveyed security leaders acknowledge the complexity of identifying insider risks, yet only 23% express strong confidence in their ability to prevent such threats before significant damage occurs. The findings highlight a critical gap in proactive defense, with most organizations remaining reactive despite the growing risks posed by AI-driven threats and decentralized workforces. The report, based on a survey of 635 CISOs and cybersecurity professionals, underscores that only 21% of organizations integrate non-technical signals—such as HR data, financial stress, or psycho-social indicators—into their insider risk detection programs. Furthermore, just 12% have implemented mature predictive risk models, leaving the majority vulnerable to sophisticated insider attacks. Experts warn that without adopting behavioral intelligence and predictive analytics, organizations risk being blindsided by trusted insiders exploiting new technologies, potentially leading to severe data breaches and reputational harm.
Jul 12, 2026
Security leaders are increasingly concerned about the risks posed by both human insiders leveraging AI tools and the rise of autonomous AI agents within organizations. Employees, including senior staff, are frequently using unapproved AI services to accelerate their work, inadvertently exposing sensitive data and creating compliance gaps that may go undetected by security teams. Additionally, hostile actors are exploiting AI to fake credentials, gain trusted roles, and move laterally within corporate networks, further complicating insider risk management. At the same time, the rapid adoption of AI agents is transforming the insider threat landscape, with predictions that 40% of enterprise applications will integrate task-specific AI agents by the end of 2026. While these agents can help address cyber-skills shortages and automate security tasks, they also introduce new risks as potential insider threats themselves. Security teams face mounting pressure to quickly vet and secure these technologies, balancing the benefits of increased productivity and strategic defense with the need for robust oversight and risk mitigation.
Jun 29, 2026
Chief Information Security Officers (CISOs) are facing increasing complexity in managing cybersecurity risk as organizations become more reliant on managed service providers (MSPs), integrate artificial intelligence (AI) into business processes, and contend with expanding attack surfaces. Nearly half of organizations reported a cyberattack or data breach involving a third-party in the past year, highlighting the growing importance of robust vetting and governance processes for service providers. At the same time, the rapid adoption of AI has elevated cybersecurity to a top priority at the board level, with CISOs now expected to communicate risk and strategy more effectively to executive leadership. However, internal conflicts, unclear authority, and misaligned incentives between CISOs and other business leaders are often more damaging to incident response than the cyberattacks themselves, according to recent industry surveys. The threat landscape is intensifying, with a 20% year-on-year increase in high-severity vulnerabilities and attackers leveraging generative AI to exploit both new and old weaknesses. Security teams are under pressure to manage a greater volume of serious issues without corresponding increases in staff or budget, leading to operational strain. Effective vulnerability management now requires clear governance, defined scope, and continuous evaluation, while CISOs must balance technical risk reduction with business alignment and shared responsibility across the organization. As AI accelerates both attack and defense, CISOs are urged to rethink traditional risk management processes and foster stronger leadership alliances to ensure resilient cybersecurity postures.
Jun 29, 2026