Insider Threat Defence: Five Steps Before the Next Breach

Last updated: October 7, 2026

The easiest human attack is one your own employees run for the attackers. Verizon's 2021 Data Breach Investigation Report found that 85 percent of breaches involve a human element, according to Teramind. A separate Data Privacy Compliance Survey cited by Teramind found 70 percent of IT leaders have identified an accidental insider breach in the past year, and human error plays a role in 90 percent of cloud data breaches. The number of attackers in your environment may be smaller than you think; the number of soft targets is larger.

Teramind lays out five steps companies should take before the end of 2021 to harden the human perimeter: train, set and enforce data handling standards, protect the perimeter with DLP, expect privilege abuse, and instrument for visibility.

Quick take

• 85 percent of breaches involve a human element, per Verizon 2021 DBIR.
• 70 percent of IT leaders identified an accidental insider breach in the past year, per a cited Data Privacy Compliance Survey.
• Human error plays a role in 90 percent of cloud data breaches, per cited research.
• The average company takes more than 200 days to detect a breach, per cited research.
• More than 500,000 US cybersecurity roles were unfilled at the time of writing, per cited research.

Background: why the human perimeter keeps winning

Phishing still works. Password reuse still works. Mis-sent attachments still happen. The reason is not that humans are weak; the reason is that humans are busy, and attackers are patient. Verizon has been saying this for years, and the message keeps landing on the same deaf ears.

Meanwhile, the perimeter has moved. Workloads moved to cloud, data moved to SaaS, and identity became the new control plane. Identity is convenient because identity does the work, and identity is convenient because identity does the work too well.

Our analysis

The training of humans is the layer that is most often skipped. New tools are the easy sell to the board, training is the boring line item. Training done right is not boring; training done badly is a tickbox exercise that changes nothing. The reframing Teramind uses, borrowed from Learn Privacy, is to anchor training in five questions: why should people care, why does the organisation value it, what are the implications of failure for clients, the organisation and the individual. The questions are not optional. The questions are what make a training program land.

The DLP layer is the layer that catches what training misses. The average company takes more than 200 days to detect a breach, which makes perimeter protection the last line that does not sleep. DLP that monitors network activity in real time, and DLP that automates the response, is the only realistic answer at scale.

The privilege piece is the privilege piece most programmes miss. Entitled users have legitimate access to critical systems, which makes entitlement abuse invisible to most controls. The invisibility lever is the lever attackers use. The way to close the gap is to baseline normal behaviour, alert on deviation, and tie alerts to the data, not to the user.

Say you are a security manager in a mid-sized fintech

You map your highest-risk roles, the people who can move money, ship code or export customer records. You give them targeted phishing simulations, mandatory DLP training, and a DLP agent that flags bulk exports and unusual destinations. You give the rest of the company a quarterly short refresher. You run the program against a metric: reduction in repeat offenders, not reduction in headcount.

For the DLP playbook, the play is to keep the noise low enough that the SOC does not tune out the alerts.

Original element: decision checklist for insider threat defence

• Have you trained staff to identify PII (names, ID numbers, addresses, emails) and the consequences of mishandling it?
• Have you written, communicated and enforced clear data handling standards with manager-level accountability?
• Have you deployed DLP that monitors egress in real time and automates blocking?
• Have you baselined normal behaviour for privileged roles and alerted on deviation?
• Have you restricted data access to need-to-know with audit logging on the admin console?

What to watch next

Watch the talent market. More than half a million US cybersecurity roles were unfilled at the time of writing, per cited research, and the talent gap is the gap that is widening the human perimeter hole. The hole is the hole attackers will keep walking through, and the hole is the hole the board will eventually have to fund. Recovery costs can approach millions, so the maths favours paying now rather than paying later.

Key takeaways

• Humans are the perimeter; train them like one.
• DLP with real-time automation is the last line that does not sleep.
• Privilege abuse is invisible to most controls; baseline behaviour to find it.