The Insider Threat: Using Intelligence to Identify Employees Who Are Working Against You

Primary Audience: General Counsel, Chief Security Officers, Corporate Boards

The Risk That Comes With an Access Badge

The insider threat — the risk of harm from individuals who have been granted legitimate access to an organization's systems, information, and facilities — is consistently ranked among the most significant and least adequately managed security risks facing corporate organizations. The 2024 Ponemon Institute Cost of Insider Threats Report found that insider threat incidents cost organizations an average of $16.2 million per incident, with an average resolution time of 86 days.

High-Profile Cases: The Pattern of Insider Threat

The FBI's 'Company Man' campaign documents a case in which a US-based glass insulation manufacturer discovered that a foreign competitor had recruited an employee to systematically transfer proprietary technical specifications and manufacturing processes. The employee had legitimate access to all relevant information as part of their job function — access that made the theft operationally trivial and detection challenging.

▸ SOURCE: FBI — Company Man Campaign — economic espionage case study — foreign competitor recruited employee of US glass insulation manufacturer; trade secrets theft prosecuted under the Economic Espionage Act of 1996

In a 2014 case documented by the Department of Justice, Su Bin, a Chinese national operating an aviation technology company with Boeing business relationships, conspired with two hackers to steal sensitive technical data relating to the C-17 Globemaster III military transport aircraft. His legitimate business relationship with Boeing provided the cover and access that made the theft possible.

▸ SOURCE: DOJ Affidavit, June 2014 — Su Bin economic espionage case — aviation technology company used business relationship with Boeing to facilitate theft of C-17 technical data; Su Bin pleaded guilty to economic espionage charges

Pre-Employment Intelligence as Prevention

The most effective insider threat prevention begins before employment — with a pre-employment intelligence assessment that goes beyond standard background checks to identify indicators of insider risk: prior employment at competitors with access to directly relevant proprietary information, financial stress indicators creating vulnerability to external recruitment, connections to foreign state-affiliated entities in sensitive technology sectors.

Axiom Verify's intelligence team uses combines proprietary access to databases, financial stress indicators, corporate registry data on employee-connected entities, and human intelligence to identify insider risk indicators before access is granted.

Conclusion

The insider threat is the risk that authorized access becomes weaponized access. Intelligence — before and during employment — is the most effective tool for identifying the individuals for whom that risk is highest. Visit axiomverify.com.