These are tense times in many workplaces.

In the tech sector, 1,000 tech companies laid off more than 260,000 employees last year, with a recent New York Times headline declaring that tech layoffs are entering a new phase, which is to say more and more targeted layoffs. This continuation of the “Year of Efficiency” impacts people’s perception of their jobs in the tech industry and beyond.

According to one employee sentiment survey, 85% of respondents indicated they are worried about losing their jobs in 2024.

When coupled with companies pulling back perks (like remote work), employee anxiety over AI-related job displacement and increasing incidents of cultural conflicts spilling over into the office, it’s clear that businesses have a people problem that can’t be ignored.

The tension is palpable, and employees are fighting back, including filming their layoffs and posting them on social media.

As Wired reported in January, these are symptoms, not causes. The real problem is that employees and employers don’t trust each other.

This is an enormous risk for employees, as this environment makes it more likely that insider threats, security risks that originate from within the company, will emerge or intensify when tensions are high and motivations, including financial strain, dissatisfaction or desperation, drive individuals to act against their own organization.

That’s the bad news. The worst news is that most companies are unprepared to meet the moment.

Companies Are Not Prepared For Insider Threats

Insider threats are everywhere.

They are the middle managers, the person in the cubicle next door and the contractor who occasionally comes by to conduct service or repair. They don’t look like dark web hackers; they blend in seamlessly with the workforce behind a veneer of normalcy and trust.

They are also a company’s most significant cybersecurity vulnerability.

According to Verizon’s most recent Data Breach Investigation Report, the human element (insiders) account for 74% of data breaches as employees fall victim to social engineering attacks, make mistakes or misuse their privileged access to compromise organizational security.

Even as the vast majority of companies plan to increase their cybersecurity spending in 2024, their efforts are frequently focused on external bad actors, forgetting (or ignoring) that the call often comes from (or at least starts) inside the house.

For example, one recent analysis found that 76% of businesses detected insider threats in the past five years, and less than one-third are confident they have the right tools to guard against this threat. Incredibly, just 21% said they have a fully operational insider threat prevention program in place.

A separate survey of corporate board members found that insider threats were the second highest threat concern among business leaders, outpaced only by malware. Their assessment is based, in part, on high staff turnover, while emerging AI tools make it more likely that accidental insiders will fall for phishing scams or other account takeover attempts.

Taken together, it’s evident that many businesses have an insider threat prevention problem, and few are adequately prepared to address it.

How to Improve Defensive Readiness

There is some good news.

Insider threats might be a business’s most prominent cybersecurity threat, but it’s also the most controllable risk. After all, insiders and the threats they pose are known, allowing companies to do something to mitigate their exposure.

Here are three steps to get started:

Cultivate Human Intel

Insider threats often betray their motivation. Sometimes, they tell colleagues about their intentions. Other times, their actions speak louder than words, as attempts to work around security protocols, active resentment for coworkers or leadership or general job dissatisfaction can be a red flag that an insider threat is about to act.

Explaining the impact of human intelligence, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) writes, “An organization’s own personnel are an invaluable resource to observe behaviors of concern, as are those who are close to an individual, such as family, friends, and coworkers.”

Cultivating human intel means creating a culture where people feel safe and empowered to say something when they see something. It’s not about “ratting out” co-workers. It’s embracing a shared responsibility for company and customer IT integrity.

Actively Monitor Digital Activity

Human intelligence is an important part of an insider threat prevention program, but it’s not enough to stop insiders, especially since today’s decentralized and cloud-based operational models mean that employees can often access, misuse or accidentally expose sensitive data anytime, anywhere.

That’s why companies should actively monitor every employee’s digital activity. Specifically, this includes:

• User activity monitoring: Digital activity can identify malicious or risky activities that put data integrity at risk.
• User and entity behavior analytics: Identify anomalous behavior that can indicate a problem, empowering leaders to investigate a potential threat before it’s too late.
• Endpoint monitoring: Stop data exfiltration in real-time, preventing employees from creating data breaches or compromising IT integrity.

These software solutions harden a company’s defenses, making it less likely that an insider threat will create a data disaster.

Minimize Errors and Mistakes

Many insider threats aren’t malicious. They are ignorant of the risks or unaware that their actions can have outsized consequences.

For instance, clicking on a single phishing scam can provide external threat actors with unbelievable access to a company’s IT infrastructure. Similarly, failing to update software or declining to regularly update passwords can put companies at risk.

These may not seem like sophisticated cybersecurity threats, but these errors and mistakes cost companies millions of dollars and damage their reputation for years to come.

It’s Time To Get Ready

These are indeed tense times in the workplace, making it more likely that insider threats will negatively impact a company.

That’s why now is the time to get ready. Understand the risks, assess your defensive posture and begin taking steps now to elevate your insider threat prevention strategies.