Insider Threat

What is an Insider Threat?

An insider threat is the risk that someone who has, or once had, legitimate access to an organisation’s people, sites, systems or data uses that access, intentionally or unintentionally, to cause harm. It covers current and former employees as well as suppliers, contractors and service technicians. In OT environments the security risk is particularly high, because insiders often work directly with PLCs, SCADA, HMIs and the Engineering Station, and can therefore influence a physical process.

An insider does not need to get past the firewall: they are already behind it. That is why this threat calls for different controls than attacks from outside.

🧠 What types of insider threats are there?

The US agency CISA distinguishes four main types, with the unintentional insider further split into negligent and accidental. The classification is useful beyond the US because each type calls for different countermeasures.

CISA also lists five expressions of insider threat: violence, espionage, sabotage, theft and cyber. In industrial environments the main concerns are sabotage (damaging equipment or code), theft of intellectual property such as recipes and PLC programs, and cyber incidents such as introducing Malware.

In practice, unintentional insiders cause most incidents: think of Phishing, reused passwords or a laptop that is used both in the office and on the plant floor. Malicious insiders are rarer, but the damage they do is often greater, because they know exactly where the process is vulnerable.

🏭 What does an insider threat look like in industrial networks?

Typical scenarios in a factory, water utility or power plant:

• Undocumented change - an engineer modifies PLC code without a change request, so nobody recognises the deviation later.
• Bypassed protection - an operator bypasses Safety interlocks via the HMI to fix a fault “quickly”.
• Own software - a maintenance technician installs an untested, unapproved tool on the Engineering Station.
• Leftover access - a former employee retains an account on the VPN or Jump Server.
• Excessive permissions - a temporary contractor gets administrator rights on the entire SCADA system instead of only the part they work on.

Two well-known incidents show how this plays out. In Maroochy Shire (Australia), Vitek Boden used his knowledge as a former employee of the company that installed the council’s sewage control system. After he was turned down for a job at the council, he sent radio commands to pumping stations at least 46 times between February and April 2000, causing hundreds of thousands of litres of raw sewage to flow into parks and rivers. He was sentenced to two years in prison. In Ellsworth, Kansas, a former employee of the Post Rock Rural Water District logged in to the remote monitoring system from his phone in March 2019, two months after leaving, using a shared password, and shut down treatment processes. He pleaded guilty in 2021. Both incidents came down to access that was not revoked after the person left.

In OT, insider threats are often hard to detect, because the actions look legitimate: an engineer downloading a PLC program is doing nothing unusual.

🔍 How does an insider threat differ from an external threat?

The line blurs with a collusive insider or a stolen account: an external attacker with valid credentials behaves like an insider. That is why Zero Trust and insider controls complement each other well.

🔐 Which controls reduce insider threats?

Insider threats require a combination of technical, organisational and human controls:

• Least Privilege - grant only the rights someone needs for their task, and no longer than necessary.
• RBAC and segregation of duties - define rights per role, so that one person cannot both make and approve a change.
• PAM - manage administrator accounts centrally, with time-limited access and Session Recording for sessions on critical systems.
• MFA and 802.1X - strong Authentication for users and devices; no shared accounts on HMIs and jump servers.
• Logging and anomaly detection - collect logins, PLC downloads and configuration changes in a SIEM and watch for deviations.
• Group Policy and Hardening - block unnecessary software and ports, and use USB Control for removable media.
• Change Management - every change to PLC logic or SCADA configuration goes through a registered, approved request.
• Third-party access - let suppliers work only through a controlled Jump Server or Remote Access solution, and assess them through Third Party Risk Management.
• Security Awareness - train OT staff to recognise phishing and to report suspicious behaviour by colleagues.

🧭 How do you set up an insider threat programme step by step?

1. Identify critical roles and systems. Which roles can shut down a process or affect a SIS? These are the roles that deserve extra attention.
2. Screen at hiring. In the Netherlands you request a Certificate of Conduct (VOG) from Justis; for positions of trust in vital sectors, a security clearance investigation by the AIVD may apply.
3. Manage the full account lifecycle. Link HR to access management, so that accounts are adjusted when someone changes role and revoked on the day they leave, including VPN, cloud portals and local PLC passwords.
4. Monitor behaviour in context. Signals include access outside working hours, attempted privilege escalation, configuration changes without a change request and connections to unknown devices. Combine technical signals with HR signals, such as a conflict or an announced departure.
5. Prepare the response. Include insider scenarios in your Incident Response plan, with agreements between security, HR and legal on privacy and evidence handling.
6. Review periodically. Check all permissions and unused accounts at least once a year.

The CERT Division of Carnegie Mellon University bundled the lessons from hundreds of insider cases into the Common Sense Guide to Mitigating Insider Threats; the seventh edition, published in September 2022, contains 22 best practices.

📜 Which standards and laws address insider threats?

In the water sector and the energy sector the topic matters even more, because an insider there can directly affect public health or security of supply.

❓ Frequently asked questions

What is an insider threat in simple terms?

An insider threat is the risk that someone with legitimate access, such as an employee, former employee or supplier, harms the organisation. This can happen deliberately, for example out of revenge, or unintentionally, for example through an infected USB stick.

Is a former employee also an insider?

Yes, a former employee counts as an insider threat as long as they hold knowledge or access gained during their employment. Accounts, shared passwords and remote access that were not revoked were the cause of well-known OT incidents such as Maroochy Shire and Post Rock.

Why are insider threats in OT hard to detect?

Insider threats in OT are hard to detect because the actions are technically legitimate: an engineer is allowed to download a PLC program and an operator is allowed to change setpoints. Only context, such as the time of day, a missing change request or unusual systems, makes the anomalous behaviour visible.

Are suppliers and contractors an insider threat too?

Yes, suppliers and contractors with access to systems or sites fall under the third-party insider category. Their risk is often higher than that of in-house staff, because they sometimes have permanent remote access and sit outside the organisation’s own HR processes.

Which control helps most against insider threats?

No single control fully prevents insider threats, but strict access management based on least privilege, combined with revoking access immediately when someone leaves, prevents many incidents. Monitoring and change management ensure that the remaining cases are discovered sooner.

Does NIS2 require measures against insider threats?

NIS2 does not mention insider threats literally, but Article 21 does require human resources security, access control policies, asset management, training and multi-factor authentication. In the Netherlands these requirements have applied through the Cyberbeveiligingswet since 15 August 2026.

📌 In summary

An insider threat is the risk that people with legitimate access, such as employees, former employees or suppliers, intentionally or unintentionally harm industrial systems. With least privilege, segregation of duties, tight account management, monitoring and training, you can control this underestimated risk while meeting NIS2 and the Cyberbeveiligingswet at the same time.