Insider Threat Statistics and Countermeasures for UK Businesses

Insider threats cost the average organisation $19.5 million in 2025, according to the Ponemon Institute’s 2026 Cost of Insider Risks Global Report, sponsored by DTEX. That figure has risen every year the study has run. Most of the damage doesn’t come from spies or saboteurs. It comes from ordinary staff making mistakes, cutting corners or having their accounts taken over.

For UK and Irish organisations, there’s an extra layer. Any response has to work within UK GDPR, the Data Protection Act 2018 and, in Ireland, GDPR as enforced by the Data Protection Commission. Much of the advice online is written for US companies and skips this part entirely.

This guide covers the latest corporate security statistics on insider threats and the main types of insiders. It also looks at real UK prosecutions, where physical and cyber security overlap, and the countermeasures the data says actually reduce costs. It finishes with a short checklist and answers to the questions security and HR teams ask most often.

Insider Threats in 2026: The Key Statistics

Two large studies give the clearest picture of insider threats right now. Ponemon’s cost research measures what insider incidents cost organisations, while Verizon’s breach data shows how often insiders appear in confirmed breaches.

How Much Insider Incidents Cost

Ponemon’s 2026 report, published in February 2026, found that annual insider risk costs reached $19.5 million per organisation in 2025. The previous edition put the figure at $17.4 million. Organisations recorded an average of 25.4 incidents across the year, which shows that insider threats are a routine operational issue rather than a rare event.

Containment is the single biggest cost line, at $247,587 per incident. Escalation, by comparison, costs $39,728 per incident. In other words, the money goes on cleaning up rather than on spotting problems early.

Negligent, Malicious and Compromised: The Split

Negligence is the largest and fastest-growing category. The report puts the annual cost of negligent insiders at $10.3 million, up 17% on the year before. Organisations logged an average of 13.8 negligent incidents, each costing around $747,107.

Malicious insiders and credential theft make up the rest. The report groups them under three headings: negligent or mistaken employees, malicious insiders, and “outsmarted” employees whose credentials are stolen. Each needs a different response, which is why a single blanket control rarely works.

Detection and Containment Timelines

The average time to contain an insider incident fell to 67 days in 2025, down from 86 days in 2023. Ponemon called this the fastest improvement the study has recorded. The link between speed and cost is direct.

Organisations that contain incidents within 30 days spend $14.2 million a year on insider risk. Those taking longer than 90 days spend $21.9 million. That $7.7 million gap is the strongest financial argument for faster detection.

What Verizon’s Breach Data Adds

Verizon’s 2026 Data Breach Investigations Report looks at confirmed breaches rather than all incidents. Internal actors appeared in 12% of breaches, down from 18% the year before. That’s a smaller share than many vendor headlines suggest.

The motives are telling. Convenience was the most common reason for insider misuse at 60%, ahead of financial gain at 33%. Think of someone emailing files to a personal account to finish work at home. End users made up 75% of internal actors, with system administrators at 19%.

Statistic	Figure	Source
Average annual insider risk cost	$19.5 million	Ponemon/DTEX 2026
Annual cost of negligent insiders	$10.3 million	Ponemon/DTEX 2026
Average insider incidents per year	25.4	Ponemon/DTEX 2026
Average days to contain	67	Ponemon/DTEX 2026
Containment cost per incident	$247,587	Ponemon/DTEX 2026
Breaches involving internal actors	12%	Verizon DBIR 2026
Insider misuse driven by convenience	60%	Verizon DBIR 2026

What Counts as an Insider Threat?

An insider threat is any risk that comes from someone with legitimate access to your systems, data or buildings. That includes employees, contractors, agency staff, suppliers, and former staff whose access was never removed. If any of these terms are unfamiliar, our glossary of key cyber definitions explains them in plain English.

The useful question isn’t “who might betray us?” It’s “what could go wrong with the access we’ve already handed out?” The four types below cover almost every case.

The Careless Insider

This is the person who sends a spreadsheet to the wrong email address or stores client files in a personal cloud account. They might also approve a request without checking it. They don’t mean harm. They’re usually busy, under pressure or working around a clunky process.

Because negligence drives the largest share of insider costs, this group deserves the most attention. The fix is partly technical and partly cultural, which our guide to the human factor in cybersecurity explores in more depth.

The Malicious or Coerced Insider

A smaller group acts deliberately, for money, revenge or pressure from outside. The Coinbase breach disclosed in May 2025 shows how this plays out. Criminals bribed overseas customer support agents to copy customer data from internal support tools.

Around 69,000 customers were affected, according to the company’s filing with the Maine Attorney General. Coinbase refused a $20 million extortion demand. It estimated remediation and reimbursement costs at between $180 million and $400 million.

The Compromised Account

Sometimes the insider isn’t a person at all. It’s an attacker using a real employee’s stolen login. From the network’s point of view, that activity looks legitimate because the credentials are valid.

Phishing, pretexting, and MFA fatigue are the usual routes in, and our guide to social engineering attacks covers each method. Strong, unique passwords stored in one of the top password managers close off the easiest path.

Shadow AI and AI Agents

The newest category involves staff pasting company data into unapproved AI tools. Ponemon found that 92% of organisations say generative AI has changed how employees access and share information. Only 13% have formally built AI into their business strategy.

The report also found that 73% worry unauthorised AI use is creating hidden paths for data to leave the business. Just 18% have fully integrated AI governance into their insider risk work. AI agents raise a further question, because they act with delegated access. DTEX chief executive Marshall Heilman warned that “insider risk management and AI agent security are quickly converging.”

UK Cases: What Insider Misuse Looks Like in Practice

In the UK, staff who misuse personal data can face criminal charges under section 170 of the Data Protection Act 2018. The offence covers knowingly or recklessly obtaining, disclosing or selling personal data without the controller’s consent.

Two recent prosecutions by the Information Commissioner’s Office show how insider threats are usually spotted. In July 2025, former insurance claims adviser Qonain Hussain was fined £1,500 at Leeds Crown Court. He worked for BISL Ltd, a car insurance intermediary.

The ICO found he had accessed 1,550 customer records between April and November 2020. Much of that access happened outside his scheduled working hours or while he was on annual leave. That pattern is exactly what access logging and behavioural baselines are designed to catch.

In an earlier case, a manager at Enterprise Rent-A-Car pleaded guilty after accessing over 200 customer records without a business reason. His employer first became concerned when he visited the workplace outside scheduled hours on a Sunday. He was fined £265 plus costs and a victim surcharge.

Both cases share a lesson. The warning sign was timing, not technology. Section 170 offences are punishable by fines rather than prison, so the real deterrent for employers is spotting unusual access early.

Where Physical and Cyber Security Meet

Most insider threat advice treats the problem as purely digital. The Enterprise case shows why that’s a mistake. A physical visit out of hours was the first clue, and it only became meaningful once someone linked it to system activity.

Physical gaps make insider threats easier to carry out. Tailgating through secure doors, borrowed or cloned access badges, and unescorted visitors all let people reach places they shouldn’t. Unattended screens and papers left on desks do the rest.

Removable media is another route. A USB stick can carry thousands of records out of a building in seconds. A hardware keylogger can sit unnoticed on a shared machine for weeks. Blocking unapproved USB devices by policy removes most of this risk at little cost.

The biggest gain comes from joining the data together. Picture a badge log showing someone entering the building at 11 pm. If the network shows a large download from their account minutes later, that combination deserves a look. Neither event alone might trigger an alert.

In the UK, the National Protective Security Authority (NPSA) publishes personnel and physical security guidance on insider risk. It’s a sensible starting point for facilities and security managers who want a joined-up approach.

Technical Countermeasures Mapped to the Data

Technical controls work best when each one answers a specific problem in the statistics. The table below links the main insider threat types to the control that addresses them most directly.

Insider type	What the data shows	Main technical control
Careless insider	$10.3m annual cost, 13.8 incidents a year	Data loss prevention and clear labelling
Malicious insider	Bribery and deliberate data theft	Least privilege and behavioural analytics
Compromised account	Valid credentials used by outsiders	Multi-factor authentication and identity checks
Convenience misuse	60% of insider misuse in breach data	Approved, easy-to-use sharing tools

Least Privilege and Identity Management

Every account should have the minimum access needed for the job, and no more. Permissions tend to pile up as people change roles, so regular access reviews matter as much as the initial setup.

Ponemon found that identity management delivered the largest cost savings of any technology studied, cutting insider risk costs by $6.1 million a year. That makes it the obvious first investment for most organisations.

Behavioural Analytics

User and entity behaviour analytics (UEBA) learns what normal activity looks like for each user and flags departures from it. An adviser opening hundreds of records on a day off, as in the BISL case, would stand out immediately.

Behavioural intelligence delivered the second-largest saving in the Ponemon study, at $5.1 million a year. It’s most useful when alerts go to a person who understands the context, rather than straight into automated discipline.

Data Loss Prevention and Encryption

Data loss prevention (DLP) tools watch for sensitive data leaving through email, cloud uploads, removable media or AI tools. Modern DLP can block an upload, warn the user or simply log the event.

Encryption limits the damage when data does leave. A stolen laptop or misdirected file is far less harmful if the contents can’t be read. Our explainer on understanding encryption covers the options in plain terms.

Privileged Access and Just-in-Time Rights

Administrator accounts are prime targets for insider threats and outside attackers alike. Privileged access management (PAM) stores these credentials securely and records how they’re used.

Just-in-time access goes a step further. Instead of holding permanent admin rights, staff request elevated access for a set task and period. When the window closes, the rights disappear, which shrinks the opportunity for misuse.

Administrative Countermeasures and Lawful Monitoring

Technology alone won’t stop insider threats. Policies, HR processes and the law all shape what an organisation can and should do. The three areas below are where UK and Irish organisations most often fall short.

Leaver and Mover Protocols

The notice period is a high-risk window. Someone leaving for a competitor may be tempted to take client lists or project files with them. A clear leaver process reduces that temptation and the opportunity.

Good practice starts with reviewing access as soon as notice is given. Remove access to sensitive systems that are no longer needed, then disable all accounts on the final day. Movers need the same care, because old permissions often survive a role change. Stale access is one of the quietest ways insider threats build up over time.

Monitoring Staff Within UK GDPR

Monitoring for security is lawful, but it has limits. The ICO’s guidance on monitoring workers sets out what employers must do. Monitoring needs a clear purpose, a lawful basis and the least intrusive method that achieves it.

Workers must be told about monitoring in terms they can understand. A data protection impact assessment is expected for monitoring likely to pose a high risk, such as covert, continuous or extensive monitoring. Irish employers face equivalent GDPR duties, with the Data Protection Commission as regulator.

The ICO’s own research shows why this matters for trust. Around 70% of people said they would find workplace monitoring intrusive. Only 19% would feel comfortable taking a new job if they knew their employer would be monitoring them.

Our view is simple. Blanket keystroke logging, screenshots, and webcam capture damage workplace trust, create legal exposure and rarely stop a determined insider. Targeted monitoring of sensitive systems, combined with tight access control, does more with far less intrusion.

A Cross-Functional Insider Risk Group

Insider risk sits across several teams, so no single department should own it alone. A small working group brings together IT security, HR, legal or compliance, and facilities.

Each team holds a piece of the picture. HR knows about grievances and resignations, facilities hold badge data, and IT holds access logs. Meeting regularly, with clear rules on what can be shared and why, lets the group act early and fairly.

Ponemon’s research suggests the effort pays off. Organisations with an established insider risk programme prevented an average of seven incidents in 2025 and avoided around $8.2 million in costs.

A Quick Insider Risk Checklist

Use the points below as a starting audit for your own organisation. They follow the statistics above, so the areas with the biggest cost impact come first.

• Access reviews: Check that every account has only the access its current role needs.
• Identity controls: Turn on multi-factor authentication for all remote and privileged access.
• Leaver process: Review access when notice is given and disable accounts on the final day.
• Behavioural baselines: Flag out-of-hours access to sensitive records for human review.
• Data loss prevention: Monitor uploads to personal cloud storage, email and AI tools.
• Physical controls: Stop tailgating, audit badge access and enforce a clear desk policy.
• Removable media: Block unapproved USB devices by default.
• AI policy: Publish a list of approved AI tools and what data can go into them.
• Lawful monitoring: Complete a data protection impact assessment before introducing new monitoring.
• Reporting route: Give staff a safe, confidential way to raise concerns.

Insider threats are mainly a problem of access, habits and timing rather than rogue spies. The data points in one direction. Tighten identity and access controls first, then add behavioural monitoring that stays within the law.

Start with the checklist above and pick the two weakest areas. For most organisations, those will be leaver processes and access reviews. For the wider context behind these figures, our global cybersecurity threats statistics page tracks the latest trend data across all major attack types.

Frequently Asked Questions

These answers cover the questions that come up most often when organisations start taking insider threats seriously. Each draws on the sources used earlier in the guide.