Until now, most insiders have acted alone and have targeted private businesses mainly for financial gain. That pattern is starting to change.
State-owned corporations and government agencies control large budgets, citizen data and critical infrastructure, making them increasingly attractive targets for criminals. The question isn’t whether insider-as-a-service will escalate, but how soon we’ll find ourselves confronting this threat on a much larger scale.
John Doe for hire
Imagine one day in the corporate world. A company opened a position for a software developer, interviewed candidates, made background checks and selected a promising candidate. There was nothing special about the hiring process. However, everything changed on the first day of the probation period.
Early one morning, a new employee tried to install malware on the company workstation using a USB drive. Security tools detected the attempt immediately, blocked it and alerted the cybersecurity team. The workstation was remotely isolated from the network before malware could spread.
No visible damage was done, but the real problem was how this person got in. Criminals had used stolen identity data and AI-enhanced photos to pass background checks, including a video interview. The new hire was not who they claimed to be. It was an impostor.
Police discovered that criminals targeted finance and technology companies on the Fortune 500 list, as well as small firms with 12 or fewer employees. They primarily targeted cryptocurrency wallets, credit card data and other monetary records. Access to intellectual property, trade secrets and internal documents was a valuable bonus.
It takes only one additional step for these attacks to become a scalable service. If criminals can reliably recruit and place insiders, they can sell this access to the highest bidder. How confident are you that none of your new employees have been planted for this purpose?
Reverse insider: Recruiting your staff
Another insider-style attack in 2024 showed how criminals could “reverse” traditional insider threats by exploiting your real employees during the hiring process.
Criminals used LinkedIn as a staging ground. They impersonated an HR manager from an IT company working on a blockchain project. A recruiter offered a good position with a salary, medical insurance and other benefits. The trick was that it was a fake job offer.
The recruiter suggested a code review as part of the hiring test. The victim accessed a legitimate Bitbucket repository and cloned the code into their personal account. The attackers’ goal was simple: trick someone into running that code from a corporate workstation. That was how the malware ended up being deployed inside the corporate network.
Consequently, trusted personnel have become a new source of data breaches, unknowingly exposing sensitive information. The same techniques can evolve into insider-as-a-service, where criminals take paid requests to infiltrate specific companies. They could target staff in particular departments, like R&D or sales, to gain access to specific data.
The development of insider-as-a-service can disrupt operations and expose confidential data. Instead of dealing with isolated rogue employees, companies will face organised services for hire. To counter the rising threat, companies must strengthen security measures to avoid financial losses caused by data breaches.
Practical steps to counter insider-as-a-service
As insider threats are evolving toward insider-as-a-service, organisations need to strengthen their defences. Below are several practical and effective ways to reduce this risk.
It’s almost impossible to protect confidential data if no one knows what data the company possesses, where this data is located and who processes it. That’s why the first step should always be data discovery, followed by an audit of user access rights. The most effective way to handle these tasks is by using Data-Centric Audit and Protection (DCAP) software. Advanced DCAP tools are particularly efficient because they analyse the content of the discovered files, not only file attributes. This approach improves both accuracy and efficiency, enabling a solution to reliably protect data.
Another core system for insider risk prevention is Data Loss Prevention (DLP) software. These solutions protect all major data transfer channels and business collaboration tools. Thus, a DLP tool safeguards against intentional and accidental data leaks.
Core features of DLP systems for insider threat mitigation are e-forensics tools. E-forensics allows the security team to discover details of incidents or suspicious actions, like whether a screenshot was taken to make a quarterly report or whether it was taken to leak sensitive data. Analytical capabilities are crucial because insiders could leak data during business activities, and it’s a must to discover the nature of the intentions behind actions.
Just as important is cybersecurity awareness training. Such training reduces the chances that employees will accidentally breach security rules. Employees need to recognise red flags in emails, messages, and “too good to be true” job offers. Training also teaches personnel that data is also a corporate asset on par with workstations or financial resources.
There are viable strategies to counter insider threats, including specialised software and security training programs. Insider-as-a-service may still be emerging, but it is no longer a distant scenario. The first step is to acknowledge this reality. The next is to focus in the tools, processes and training needed to stay ahead of it.
