Topic
A security risk from employees, contractors, or other trusted individuals who misuse legitimate access to steal data, sabotage systems, or aid attackers.
New Zealand's NCSC says a North Korean operative hired as a remote IT contractor threatened to leak a large business's sensitive data once exposed. Coder Trove counts five of the 10 steps in a fake remote hire as running through HR.
Reality
Federal prosecutors charged OpenAI engineer Abdulrahman Alfozan with planting an encrypted recording device in an executive conference room. OpenAI says it has no indication that source code, model weights or customer data were taken.
Perspective Coverage
13 publishersReality
The Justice Department searched more than 40 Texas laptop farms serving North Korean IT workers and seized over 180 company-shipped computers. Prosecutors count at least 70 victim companies. For employers, the shipping address is now a control point.
Perspective Coverage
6 publishersReality
FBI says North Korean IT workers increasingly depend on witting and unwitting Americans to win jobs at U.S. companies. The bureau says no single indicator catches them, so employers have to weigh several signals together.
Reality
Federal prosecutors announced a 32-month sentence for a former employee who set about 16 scheduled tasks on a domain controller and demanded 20 BTC. The attacker used a legitimate admin account and standard tools, so the signals to catch were an unauthorized VM and the gap before the tasks ran.
Reality
Daniel Rhyne got 32 months in federal prison for planting scheduled tasks on his industrial employer's domain controller that locked the firm out. Access to that one server let a single engineer delete or reset 318 accounts and change local administrator passwords on 3,538 machines.
Reality
Intel 471 tracked a $50,000 bounty for an introduction to a crypto exchange's KYC or compliance employee in a year of underground insider ads. Admins are still wanted, but so are support agents, tellers and logistics staff that many insider programs leave out.
Reality
Army soldier Cameron Wagenius got 70 months in prison for extorting AT&T with call records taken from Snowflake accounts that lacked MFA. His group got in with exposed credentials alone, and AT&T's $370,000 ransom did not stop the leaks that followed.
Perspective Coverage
7 publishersReality
Fed's inspector general found that unclear roles among Fed divisions left a former staffer's removal of classified FOMC files unresolved for over a year. The Fed says its fix for escalating such alerts arrives by the first quarter of 2027, and part of the removed material has not been retrieved.
Reality
Huntress found suspected DPRK workers inside an Australian healthcare company and a sales hire wearing a stolen identity, which puts the screening that catches them in the hands of recruiters and background-check vendors.
Reality
Talos says a $300 offer for an hour's phone consultation is the first stage of a con that screens security practitioners for useful access. Targets who pass end up paid to pull non-public material from co-workers and internal systems.
Reality
CISA's 2026 election security plan names outdated certification rules as one of three problems in how election system flaws get fixed. The attack path it describes starts at a compromised office inbox or workstation and moves laterally into those systems.
Reality
An updated bureau alert describes hired developers copying repositories into personal cloud accounts and then demanding payment once they are found. Seven of its eleven recommendations still sit at the hiring gate.
Reality
A Guardian investigation surfaced the 2017 assessment for moving UK criminal records and victim statements onto Azure, with US government insiders among the 15 risks its signatory accepted. Five specialists say the risk stands.
Reality
A hiring podcast argues that state-backed operations now train workers to apply for remote jobs with stolen credentials and proxy interviewers. The guest making the case works for the vendor selling the fix.
Reality
HYPR's September 15 survey of 500 US HR executives puts average unmonitored access for a fraudulent hire at 5.73 days, and the report's own detection figures undercut its chief executive's line about human intuition.
Reality
Agents show up in logs carrying the credentials of the employees whose authority they inherit. The security executives in a CSO Online account want their scope set by proxies, brokered tokens and downstream authorization before deployment.
Reality
The September 9 revision updates CISA's 2020 text on its own timeline, with no deadline attached and no incident behind it, and the topics CISA chose to add read as a checklist of the assumptions most insider threat programs have not revisited.
Reality
The 500-plus engagements behind that share are all companies that already needed an outside responder, so the figure describes how fast a bad day closes rather than your odds of having one. It still decides which of your controls can fire in time.
Reality
Pillar Security's Dor Sarig argues the non-human identity buildout answers who an agent is rather than what it does, and cites an internal agent any Slack message could trigger across a thousand private repositories.
Reality