February 09, 2026

The Inside Job: spotting security threats hiding in plain sight

Richard Dornhart
National Practice Manager - Security at Data#3

When it comes to cyber security, external attacks often dominate the headlines, but some of the most significant risks come from inside an organisation. Australian Government guidance highlights how insider threats occur when a current or former employee uses their access in a way that harms the organisation, either intentionally or unintentionally.

While malicious insiders certainly exist, research shows that more than half of insider incidents are accidental. These unintentional insiders are often trusted, well‑meaning employees who simply are not aware that their actions are putting data at risk.

Employees might email files to personal accounts, upload documents to unsanctioned AI tools, or share sensitive data without realising the implications. These actions can expose intellectual property, customer information, and compliance‑critical data.

For organisations, the challenge is clear: how do you maintain productivity while reducing human risk? Traditional approaches like data loss prevention (DLP) rely on rigid rules and heavy policy engineering, creating complexity and slowing time‑to‑value. Organisations need a smarter way that delivers comprehensive visibility into data movement, prioritised risk detection, automated response and remediation, and human risk reduction without a heavy administrative burden.

Incydr and human risk

For years, Data#3 and Mimecast have protected customers from external threats at the email gateway. However, only 28 per cent of the average workday is spent reading and answering emails, which can leave a massive gap if you only focus your security efforts there. Cyber resilience insights from Mimecast indicate that:

Based on these statistics, it’s clear that the traditional approach isn’t working. Security teams are overwhelmed, investigation times are up, and false positives are high.

Rather than relying on static policies that generate endless alerts or block legitimate activities, Incydr offers a targeted and user-centric solution:

  • Rapid visibility: Incydr delivers real-time visibility into data movements on devices, cloud storage and external destinations almost immediately after deployment. This lets you see sensitive data exposures early on, without weeks of policy engineering.
  • Risk-based prioritisation: Not every event is critical. Incydr uses a context-aware risk scoring system based on the user, data and destination. That helps your security team focus their efforts where it matters most.
  • Contextual user engagement: Many insider incidents are unintentional. Instead of hard stops, Incydr can prompt micro‑training modules or explain why an action may be risky. This guides behaviour while keeping employees productive.
  • Flexible enforcement options: Some situations require intervention. Incydr supports graduated responses from requiring user justification to temporary or full blocking, which preserves flexibility and alignment with your culture.

The “AI problem”

The rise of AI tools has pushed insider risk into new realms. Employees often use unsanctioned AI platforms to accelerate workflows, copying and uploading thousands of files. We know that AI isn’t going anywhere, so how do you secure it without being “anti-AI”? How do you protect sensitive data without blocking productivity? Incydr takes a balanced approach.

Start with a clear acceptable use policy

Clear policies are the foundation of insider risk management. They should define what employees can and cannot do with sensitive data, including guidance on AI usage. Without this clarity, organisations face compliance gaps and legal uncertainty when incidents occur. Incydr makes policies actionable by providing real-time visibility into data movement. You can see where sensitive files are going and compare activity against your policy without relying on complex configurations.

This three-dimensional approach ensures security teams can prioritise the most critical exposures first, making policy enforcement smarter and less disruptive.

Redirect to sanctioned AI tools

AI is here to stay and banning it outright is rarely practical. Instead, redirect usage to approved, secure platforms. This reduces risk while supporting innovation. With Incydr, you can identify which AI tools are being used and enforce policies that allow sanctioned platforms while blocking or flagging unsanctioned ones. This approach keeps productivity high without compromising security.

Educate through context

Most insider incidents are accidental. Employees often act with good intentions but lack awareness of the risks. Education is essential. Incydr enables micro-training nudges that appear when risky actions occur. These contextual prompts reinforce policies, explain why certain behaviours unsafe and guide employees toward approved alternatives are. Over time, this reduces risky activity without disrupting workflows.

Utilise flexible enforcement

When education isn’t enough, enforcement becomes critical. However, a “block everything” approach often creates more risk, frustrates users and encourages workarounds. Instead, Incydr offers a layered approach to ensure enforcement is proportionate to the risk.

  • Temporary allow with Justification: Users are notified that their action violates policy but can proceed after providing a reason. This creates accountability and logs the event for review.
  • Real-time blocking: For high-risk scenarios, Incydr can prevent data exfiltration immediately, stopping uploads to unsanctioned destinations or removable media.
  • Revoking access: In critical cases, organisations can revoke sharing permissions or quarantine endpoints to remove system access.

Key takeaways: visibility, prioritisation and flexible controls

Moving beyond just external threats is essential to maintaining a secure, productive environment. Organisations need a smarter approach that balances security with productivity. Incydr delivers that approach through three key pillars:

  • Comprehensive visibility without the need for complex policies or long deployment cycles.
  • Risk-based prioritisation, leveraging PRISM to focus on what matters most.
  • Flexible controls that match the risk and your company culture.

Combine these capabilities with clear policies, education and enforcement, and you create a security framework that protects sensitive data while enabling innovation. With Data#3 and Mimecast, you can uncover insider risks, respond confidently and maintain a secure, productive environment.

Stop data from quietly walking out your door, before it’s too late.

Take our five-minute assessment to receive a personalised report tailored for your organisation.