September is National Insider Threat Awareness Month, which serves both as a reminder of the challenges that insider threats can pose security teams, and also raise awareness for the best practices for preventing breaches as a result of these hidden threats.
Here is some commentary from a group of cybersecurity experts regarding Insider Threat Awareness month and insider threats in general. They are Steve Wilson, Chief AI and Product Officer at Exabeam, Aditya Sood, VP of Security Engineering and AI Strategy at Aryaka, Joshua Roback, Principal Security Solution Architect at Swimlane, and Pete Luban, Field CISO at AttackIQ.
Steve Wilson, Chief AI and Product Officer at Exabeam:
“The danger from insider threats continues to grow in the modern cyber landscape, particularly as AI accelerates their speed, stealth, and sophistication. With 64% of cybersecurity professionals now viewing insiders as a greater risk than external actors, Insider Threat Awareness Month serves as a critical opportunity to emphasize proactive defense strategies.
While 88% of organizations have insider threat programs, many lack behavioral analytics needed to detect AI-enhanced attacks that exploit trusted access and mimic legitimate user behavior. As threats intensify across sectors like government, healthcare, and manufacturing, this initiative provides an opportunity to call for stronger governance, cross-functional collaboration, and real-time detection capabilities to stay ahead of both human and AI-driven insider risks.”
Aditya Sood, VP of Security Engineering and AI Strategy at Aryaka:
“Insider Threat Awareness Month is a critical initiative for raising awareness about the unique security risks posed by internal actors. There have been several examples of insider threats wreaking havoc on major corporations, with Elon Musk’s X being the most prominent recent example.
A malicious insider is a significant cybersecurity risk, as such individuals can steal intellectual property, exfiltrate confidential information, sabotage systems, or manipulate business operations for personal gain or in collusion with outside threats. The impact can range from financial losses and reputational damage to regulatory penalties and national security risks.
Awareness about malicious insider activities is crucial because employees and stakeholders must understand the importance of safeguarding credentials, and the necessity of reporting suspicious activity. By teaching employees to recognize the signs of suspicious behavior and reinforcing the importance of strict access controls and reporting protocols, organizations can transform our entire workforce into a crucial line of defense against internal threats. Employees’ role in this is not just important: it’s indispensable. They are the first line of defense, and their commitment to this cause is what will keep organizations secure.”
Joshua Roback, Principal Security Solution Architect at Swimlane:
“Insider threats have always been one of the hardest challenges for security teams because they originate from people with legitimate access. Unlike external adversaries, they don’t have to find a way in. They already have the keys. That makes their actions harder to spot and far more damaging when they turn malicious or careless.
It’s up to organizations to ensure their security systems are well-protected, starting with determining who has access to which systems. Poorly managed access controls creates an environment for insider threats to sprout and thrive. Implementing a mature identity access management solution is the most powerful weapon in mitigating insider threat risks. User behavioural analytics (UBA) can provide proactive detection of anomalous user behaviors, giving security teams a leg up against unannounced attackers.
The rise of insider threats has resulted in the development of security measures which can ensure that threats are monitored, analyzed, and neutralized before they escalate into catastrophic breaches. Building resilience has required organizations to combine continuous monitoring, automated response, and a strong security culture to reduce the window of opportunity for insider abuse.”
Pete Luban, Field CISO at AttackIQ:
“Insider threats, whether from disgruntled employees or compromised credentials, are difficult to detect and prevent with traditional security measures. Insider Awareness Month serves as a reminder to security teams about the importance of simulating real-world insider attack scenarios to assess the effectiveness of their security controls and response protocols.
Recent spikes in shadow AI usage and lack of proper cyber hygiene increase the likelihood of insider threats. Use of unauthorized tools or platforms can unknowingly expose sensitive data or create exploitable vulnerabilities, as well as poor security practices, like maintaining out-of-date software or weak passwords.
By integrating techniques, such as adversarial emulation, into the security lifecycle, organizations can uncover gaps in their detection and mitigation strategies before a real attack occurs. Simulated, continuous testing can ensure that security teams can mitigate attacks before insider threats sidestep defenses and steal valuable company data.”
Insider Threat Awareness Month highlights key threats and opportunities
Posted in Commentary on September 5, 2025 by itnerdSeptember is National Insider Threat Awareness Month, which serves both as a reminder of the challenges that insider threats can pose security teams, and also raise awareness for the best practices for preventing breaches as a result of these hidden threats.
Here is some commentary from a group of cybersecurity experts regarding Insider Threat Awareness month and insider threats in general. They are Steve Wilson, Chief AI and Product Officer at Exabeam, Aditya Sood, VP of Security Engineering and AI Strategy at Aryaka, Joshua Roback, Principal Security Solution Architect at Swimlane, and Pete Luban, Field CISO at AttackIQ.
Steve Wilson, Chief AI and Product Officer at Exabeam:
“The danger from insider threats continues to grow in the modern cyber landscape, particularly as AI accelerates their speed, stealth, and sophistication. With 64% of cybersecurity professionals now viewing insiders as a greater risk than external actors, Insider Threat Awareness Month serves as a critical opportunity to emphasize proactive defense strategies.
While 88% of organizations have insider threat programs, many lack behavioral analytics needed to detect AI-enhanced attacks that exploit trusted access and mimic legitimate user behavior. As threats intensify across sectors like government, healthcare, and manufacturing, this initiative provides an opportunity to call for stronger governance, cross-functional collaboration, and real-time detection capabilities to stay ahead of both human and AI-driven insider risks.”
Aditya Sood, VP of Security Engineering and AI Strategy at Aryaka:
“Insider Threat Awareness Month is a critical initiative for raising awareness about the unique security risks posed by internal actors. There have been several examples of insider threats wreaking havoc on major corporations, with Elon Musk’s X being the most prominent recent example.
A malicious insider is a significant cybersecurity risk, as such individuals can steal intellectual property, exfiltrate confidential information, sabotage systems, or manipulate business operations for personal gain or in collusion with outside threats. The impact can range from financial losses and reputational damage to regulatory penalties and national security risks.
Awareness about malicious insider activities is crucial because employees and stakeholders must understand the importance of safeguarding credentials, and the necessity of reporting suspicious activity. By teaching employees to recognize the signs of suspicious behavior and reinforcing the importance of strict access controls and reporting protocols, organizations can transform our entire workforce into a crucial line of defense against internal threats. Employees’ role in this is not just important: it’s indispensable. They are the first line of defense, and their commitment to this cause is what will keep organizations secure.”
Joshua Roback, Principal Security Solution Architect at Swimlane:
“Insider threats have always been one of the hardest challenges for security teams because they originate from people with legitimate access. Unlike external adversaries, they don’t have to find a way in. They already have the keys. That makes their actions harder to spot and far more damaging when they turn malicious or careless.
It’s up to organizations to ensure their security systems are well-protected, starting with determining who has access to which systems. Poorly managed access controls creates an environment for insider threats to sprout and thrive. Implementing a mature identity access management solution is the most powerful weapon in mitigating insider threat risks. User behavioural analytics (UBA) can provide proactive detection of anomalous user behaviors, giving security teams a leg up against unannounced attackers.
The rise of insider threats has resulted in the development of security measures which can ensure that threats are monitored, analyzed, and neutralized before they escalate into catastrophic breaches. Building resilience has required organizations to combine continuous monitoring, automated response, and a strong security culture to reduce the window of opportunity for insider abuse.”
Pete Luban, Field CISO at AttackIQ:
“Insider threats, whether from disgruntled employees or compromised credentials, are difficult to detect and prevent with traditional security measures. Insider Awareness Month serves as a reminder to security teams about the importance of simulating real-world insider attack scenarios to assess the effectiveness of their security controls and response protocols.
Recent spikes in shadow AI usage and lack of proper cyber hygiene increase the likelihood of insider threats. Use of unauthorized tools or platforms can unknowingly expose sensitive data or create exploitable vulnerabilities, as well as poor security practices, like maintaining out-of-date software or weak passwords.
By integrating techniques, such as adversarial emulation, into the security lifecycle, organizations can uncover gaps in their detection and mitigation strategies before a real attack occurs. Simulated, continuous testing can ensure that security teams can mitigate attacks before insider threats sidestep defenses and steal valuable company data.”
Leave a comment »