Organisations failing to proactively address insider cyber risk

With the cost of insider risk the highest it’s ever been, cyber leaders are failing to direct their budgets towards effectively addressing the problem, spending less than 10% of their security budgets on measures that could solve a problem that now costs an average of $16.2m (£13.25m) every year.

This is according to The cost of insider risks 2023 report, produced by the Ponemon Institute and insider risk management specialist DTEX Systems.

This is the eighth edition of the annual report, which covers organisations in EMEA, North America and APAC. For the 2023 edition, Ponemon and DTEX spoke to 1,075 IT and cyber security professionals at 309 organisations that had experienced a total of 7,343 insider incidents among them, an average of 24 per organisation, with each taking on average 86 days to contain, up from 85 last year.

The report defines insider risk based on MITRE’s Human Focused Insider Threat Types as either malicious or non-malicious. A malicious insider is someone who proactively seeks to do harm, through espionage, IP threat, unauthorised data disclosure, sabotage, fraud or workplace violence.

A non-malicious insider is someone who causes harm through negligence, carelessness or inattentiveness, someone who causes harm through a genuine mistake, and someone who causes harm through being outsmarted by a cyber attack or threat actor via social engineering.

The report found that non-malicious insiders account for 75% of incidents, but while malicious insider incidents were rarer, they cost more, up to $701,500 per incident.

The largest costs associated with breaches arising from insider actions centred on containment and remediation, costing $179,209 and $125,221 per incident.

But in spite of the growing cost and frequency of insider breaches, 88% of respondents are spending less than 10% of their security budgets on the issue, on average just 8.2%. The remaining 91.8% of security budgets are being directed towards external threats, despite over half of respondents attributing social engineering as the leading cause of outside attacks.

“The upward trends associated with incident costs, frequency and time to contain demonstrate that current approaches to insider risk are simply not working,” wrote the report’s authors. “In fact, the numbers clearly show we are going backwards.

“Funding is being inadvertently misdirected due in part to a widespread misunderstanding of insider risks and how they manifest based on early warning behaviours. A whole-of-industry approach is required to educate and find common ground on how we define and discuss insider risks with enterprise and government entities.

“On a positive note, more and more organisations are building insider risk programs and seeking budget and executive buy-in to fund and champion them,” they added.

“Our research echoes similar findings from other leading analysts and research organisations, notably Forrester, Gartner, MITRE Corporation and Verizon. The human is unquestionably at the centre of most data breaches – and increasingly, that human risk is an insider, right under our noses. By homing in on insider risk management, organisations have a powerful opportunity to proactively identify and mitigate insider risks well before a costly incident occurs.”