Insider threats are becoming center stage to some of the deadliest cyberattacks in recent news. Identifying insider threats is by no means an easy task, as many times, it includes zombie accounts created by users who are no longer in the organisation. The accounts exist, and when taken over, are lethal enough to carry widespread damage through their legitimate access paths. Insiders typically know what data is valuable to an organisation and where it is stored. Data breaches caused by insiders are significantly more expensive and dangerous for organisations than ones caused by an external attacker.
