What is an “Insider Threat”?
To keep it simple: an insider threat is risk that comes from within—a current or former employee, contractor, partner, or anyone with access to your systems, data, or accounts.
A recent example
We were called by a mid-sized company about a suspected insider situation. A recently terminated employee still had access and appeared to be acting maliciously. There was concern about access to email, files, and stored passwords, and even possible outreach to contacts requesting money.
What we did (at a glance)
- Regained control of all affected accounts.
- Changed passwords and enforced MFA across the tenant.
- Collected evidence (account activity, mailbox rules, file-sharing history).
- Delivered a report with findings and clear prevention recommendations.
In this case the actor was a former employee; in other cases it’s someone you’d never expect. We’ve seen well-meaning staff copy work home, or a family member use a company device. The pattern is the same: legitimate access used in risky ways.
Be ready before it happens
Preparation turns a stressful day into a routine checklist. We’ve put together two resources you can use now:
1) Insider Threats – 2025 (1-page brief)
A quick, non-technical explainer you can share with leadership: what counts as an insider threat, why it matters, and how Cenegi helps.
Download: Insider Threats 2025
2) Hands-on Offboarding Checklist (one-pager)
A practical, step-by-step sheet for the first 15 minutes, same-day cleanup, and the next 7–14 days when someone leaves or access is misused. Print it, or follow it on screen.
Download: Insider Threats Checklist
Tip: run a 15-minute tabletop with this checklist once a quarter. It keeps muscles warm and reveals gaps before they matter.
The 15-minute containment moves (snapshot)
- Suspend identity & revoke sessions (block sign-in; invalidate refresh tokens).
- Kill privileged access (remove admin roles & group memberships).
- Remove delegation (send-as/on-behalf; shared mailbox access).
- Stop exfil (disable external auto-forwarding; delete inbox rules; pause risky app consents).
- Drop sessions (terminate VPN/SSO; revoke SSH/RDP keys).
- Freeze managed devices (lock/isolate via MDM; remote wipe if policy allows).
- Snapshot evidence (auth/email/file/share/admin logs) and record timestamps.
- Document the chain (who did what/when—this becomes your chain of custody).
Then complete same-day cleanup (rotate shared secrets, remove access everywhere, reassign ownership, device intake) and 7–14 day hardening (least privilege/JIT admin, logging & alerts, MFA everywhere). The checklist covers each step in order.
Early warning signs to watch for
- New auto-forward rules or unexpected mailbox behavior
- Unusual sign-ins or off-hours admin activity
- Mass downloads or sudden burst of public link sharing
- New or suspicious app consents connected to core data
- Departures without a documented offboarding checklist
Need help?
If you want a quick dry-run or support during an incident, we can help you contain access, preserve evidence, and stabilize operations—fast.
📧 info@cenegi.com 📞 (804) 263-8110
