Content tagged here examines threats originating from within an organization, including malicious employees, negligent staff, and compromised credentials. Topics cover behavioral indicators, monitoring tools, data loss prevention, insider threat programs, and organizational policies designed to detect and mitigate risks from trusted individuals.
posts
The USB Drive in the Parking Lot Still Works In 2023, the U.S. Department of Health and Human Services warned healthcare organizations about a resurgence of USB-based attacks — threat actors dropping infected flash drives in parking lots, lobbies, and break rooms. People still plug them in. That single act
A USB Drive in the Parking Lot Changed Everything In 2023, the Department of Homeland Security ran a test. They scattered USB drives in the parking lots of government buildings and private contractors. Forty-eight percent of the people who picked them up plugged them into a work computer. Nearly all
In 2019, a former employee of Capital One walked into an AWS cloud environment — digitally, not physically — but the breach that exposed over 100 million records started with exploiting trust and access. That same principle of exploiting trust is exactly how a tailgating attack in cybersecurity works in the physical
The Threat Already Inside Your Network In 2023, Tesla disclosed that two former employees had leaked the personal data of over 75,000 workers to a foreign media outlet. It wasn't a sophisticated nation-state hack. It wasn't a zero-day exploit. It was two people with legitimate
The Sticky Note That Cost a Hospital $3 Million A nurse left a sticky note with login credentials on her monitor. A visitor photographed it. Within 48 hours, a threat actor had accessed patient records for over 10,000 individuals. The resulting HIPAA settlement wasn't pretty. I'
In 2022, a former employee at Cash App's parent company, Block, downloaded reports containing the personal information of 8.2 million customers — months after they'd left the company. Their access had never been revoked. That single oversight triggered SEC filings, lawsuits, and reputational damage that took
A Single Spreadsheet Cost One Hospital $3 Million In 2023, a healthcare employee uploaded patient records to an unauthorized cloud spreadsheet tool to "make things easier" for her team. Nobody in IT knew about it. No encryption, no access controls, no audit trail. When that tool suffered a
One Employee Stole Data. The Other Just Clicked a Link. Both Cost Millions. In 2022, a former Amazon employee was convicted for her role in the Capital One breach that exposed over 100 million customer records. That same year, the Verizon Data Breach Investigations Report found that 82% of breaches
In 2023, a midsize healthcare company discovered that an employee had been syncing patient records to a personal Dropbox account for over two years. No malicious intent — just convenience. The result was a HIPAA violation, a six-figure settlement, and a brutal lesson in shadow IT risks that the organization'
Your Employees Are Building a Second Network You Can't See A marketing manager signs up for an AI writing tool using her corporate email. A developer spins up an AWS instance on a personal account to test code faster. A sales rep stores client contracts in a personal
