Insider threats take centre stage

Issue 7 2023 Information Security

John Mc Loughlin.

J2 Software, a DTEX Systems partner, has emphasised the inadequacy of current cybersecurity budgets in addressing the core cause of data breaches; insider risks. A recent survey revealed that 58% of organisations believe their budgets allocated to manage insider risks are insufficient to effectively mitigate the increasing costs and frequency of security incidents instigated by individuals within the organisation.

DTEX Systems, in collaboration with the Ponemon Institute, unveiled the 2023 Cost of Insider Risks Global Report. This independent study disclosed a 40% rise over four years in the average annual cost of insider risks, now totalling $16,2 million. Concurrently, the average duration to contain an insider incident has surged to 86 days.

J2 Software CEO, John Mc Loughlin, says that in addition to scrutinising the financial implications of insider security incidents, this year’s study sheds light on how organisations are funding their insider risk programmes. “The research highlights that nearly half (46%) of organisations are planning to bolster their investment in insider risk programs in 2024. Moreover, an overwhelming 77% of organisations have either initiated or are in the process of implementing an insider risk programme.”

As defined by research analyst Gartner, insider risk management encompasses “the tools and capabilities to measure, detect and contain undesirable behaviour of trusted accounts within the organisation.”

Mc Loughlin adds, “Despite the rising costs associated with insider risks, a substantial 88% of organisations allocate less than 10% of their total IT security budget towards managing these internal threats. Organisations boast an IT security budget averaging $2437 per employee, with a mere 8,2% ($200 per employee) designated specifically for insider risk programs and policies.”

Symptom management

DTEX Systems CTO, Rajan Koo emphasised that these findings underscore a diversion of budgets towards reactive ‘symptom management’ despite mounting evidence that the root cause lies within the human factor, represented by insider risks.

“The findings illuminate that insiders, manifesting as insider risks, are the primary cause of data breaches, including those stemming from social engineering. This highlights a pervasive misunderstanding of the various forms of insider risks and the failure to proactively safeguard customer data and intellectual property,” he added.

The 2023 Cost of Insider Risks Global Report offers a comprehensive analysis to comprehend the financial ramifications of insider risks, stemming from either negligent or inadvertent employees, outsmarted employees (including insider incidents linked to credential theft), or malicious insiders.

Dr Larry Ponemon, Chairman and Founder of the Ponemon Institute, commented, “Our goal in conducting this research is to create awareness of the significant costs incurred when employees are negligent, outsmarted or malicious in the handling of an organisation’s sensitive data.”

“We believe this study is unique because it analyses the costs based on the type of insider, the time it takes to contain the incident and the technologies that are most effective in reducing the costs. Such information is beneficial in creating a strategy to deal more effectively with the insider risk while reducing the costs.”

Key findings of the 2023 Cost of Insider Risks Global Report include:

• The average annual cost of an insider risk has risen 40% over four years to $16,2 million, up from $15,4 million in 2022.

• The average number of days to contain an insider incident in 2023 has increased to 86 days. The longer it takes to respond, the higher the cost ($18,33 million for incidents that take more than 91 days to contain).

• Organisations are spending less than 10% of their IT security budget on insider risk management. Organisations had an average IT security budget of $2437 per employee, yet only 8,2% (equivalent to $200 per employee) was allocated specifically to insider risk management programs and policies.

• Most insider risk budget is spent after an insider incident has occurred. Only 10% of insider risk management budget (averaging $63 383 per incident) was spent on pre-incident activities: $33 596 on monitoring and surveillance, and $29 787 on ex-post analysis (this includes activities to minimise potential future insider incidents and steps taken to communicate recommendations with key stakeholders). The remaining 90% (averaging $565 363 per incident) was spent on post-incident activity cost centres: $179 209 on containment, $125 221 on remediation, $117 504 on investigation, $113 635 on incident response, and $29 794 on escalation.

• Insider risk programme funding is set to increase. Despite the fact that most organisations allocate an average of 8,2% of their IT security budgets to insider risk programs, 58% view current spending as inadequate and 46% expect funding to increase in the next year. Seventy-seven percent of organisations have started or are planning to start an insider risk programme.

• Non-malicious insiders cause most insider incidents. 75% percent of respondents said the most likely cause of insider risk is non-malicious; a negligent or mistaken insider (55%), or an outsmarted insider who was exploited by an external attack or adversary (20%).

• More than half of non-insider attacks are caused by social engineering. Fifty-three percent of organisations said social engineering (including phishing, pretexting and business email compromise) was a leading cause of non-insider or external attacks.

• Financial services and service organisations have the highest average activity costs. The average activity cost for financial services is $20,68 million, and services (including accountancy, consultancy and professional services firms) are $19,09 million.

• Top-down support is the gold standard. Among organisations that have, or plan to have, a dedicated insider risk programme, 52% report that top-down support and championing of the programme (e.g., an insider risk steering committee) is a key feature. Fifty-one percent have a dedicated cross-functional team from legal, human resources, line of business and IT security.

• AI/ML is essential to insider risk management. One-third of organisations view artificial intelligence and machine learning as essential to the prevention, investigation, escalation, containment and remediation of insider incidents, while 31% view it as very important.

For more information, contact J2 Software, +27 11 794 1096,,

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Access & identity expectations for 2024
Technews Publishing IDEMIA ZKTeco Gallagher Salto Systems Africa Regal Distributors SA Reditron Editor's Choice Access Control & Identity Management Information Security AI & Data Analytics
What does 2024 have in store for the access and identity industry? SMART Security Solutions asked several industry players for their brief thoughts on what they expect this year.

Prepare for cyber-physical attacks
Gallagher Information Security Access Control & Identity Management
As the security landscape continues to evolve, organisations must fortify their security solutions to embrace the changing needs of the security and technology industries. Nowhere is this more present than with regard to cybersecurity.

Zero Trust and user fatigue
Access Control & Identity Management Information Security
Paul Meyer, Security Solutions Executive, iOCO OpenText, says implementing Zero Trust and enforcing it can create user fatigue, which only leads to carelessness and a couldn’t care attitude.

Passwordless, unphishable web browsers
Access Control & Identity Management Information Security
Passkey technology is proving to be an easily deployed way to bring unphishable, biometric-based security to browsers; making identification and authentication much more secure and reliable for all parties.

Time is of the essence
Information Security
Ransomware attacks are becoming increasingly common. Yet, many individuals and organisations still lack a clear understanding of how these attacks occur and what can be done to secure their data.

All aspects of data protection
Technews Publishing Editor's Choice Information Security Infrastructure AI & Data Analytics
SMART Security Solutions spoke to Kate Mollett, Senior Director, Commvault Africa, about the company and its evolution from a backup specialist to a full data protection specialist, as well as the latest announcements from the company.

The song remains the same
Sophos Information Security
Sophos report found that telemetry logs were missing in nearly 42% of the attack cases studied. In 82% of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks.

How hackers exploit our vulnerabilities
Information Security Risk Management & Resilience
Distractions, multi-tasking, and emotional responses increase individuals’ vulnerability to social engineering, manipulation, and various forms of digital attacks; 74% of all data breaches included a human element.

Projections for 2024’s Advanced Threats Landscape
News & Events Information Security
Kaspersky Global Research and Analysis Team (GReAT) experts offer insights and projections for 2024 in the Kaspersky Security Bulletin, with a focus on the evolution of Advanced Persistent Threats (APT).

Veeam and Sophos in strategic partnership
Information Security
Veeam and Sophos unite with a strategic partnership to advance the security of business-critical backups with managed detection and response for cyber resiliency, and to quickly recover impacted data by exchanging critical information.