A Comprehensive Survey of Insider Threat Landscape and Detection Indicators

Main Article Content

Fatai A. Akinsola
Francisca N. Ogwueleka
Uche M. Mbanaso

Abstract

The persistence of insider attacks underscores the inadequacy of existing organizational defense strategies, particularly those that fail to prioritize the human element in cybersecurity planning. While external threats have traditionally dominated security frameworks, this study highlights the growing risk posed by internal actors due to the general absence of comprehensive insider threat strategies. Inadequate attention to insider threats can result in significant breaches, including data theft, information leakage, fraud, sabotage, and espionage. This study reviews the underlying factors and indicators that increase organizational vulnerability to insider attacks, categorizing various insider threat types and analyzing recent cases to illustrate their operational and reputational impacts. It also examines current tactics, frameworks, and best practices developed by cybersecurity professionals to counter this threat. Key detection indicators identified in the study reveal how insider activities may expand the attack surface, posing critical risks to digitally-enabled business operations. The findings offer practical guidance for cybersecurity practitioners, emphasizing the importance of integrating behavioral, organizational, and technological indicators into the design of insider threat detection and prevention systems. The study also calls for ethical consideration in monitoring employee activities, advocating for a balance between threat mitigation and the preservation of individual rights, dignity, and workplace trust.

Article Details

References

Abomhara, M., & Køien, G. M. (2015). Cyber security and the internet of things: vulnerabilities, threats, intruders and attacks. Journal of Cyber Security and Mobility, Vol 4, No 1, pp 65-88.
Abuli, M. J. (2016). A Framework for Assessing the Insider Threat in Parastatals in Kenya (Doctoral dissertation, University of Nairobi).
Alsowail, R. A., & Al-Shehari, T. (2022). Techniques and countermeasures for preventing insider threats. PeerJ Computer Science, DOI 10.7717/peerj-cs.938
Alsowail RA & Al-Shehari T. (2021). A multi-tiered framework for insider threat prevention. Electronics. 10(9):1005, pp 1-30, DOI 10.3390/electronics10091005.
Agrafiotis, I., Nurse, J. R., Goldsmith, M., Creese, S., & Upton, D. (2018). A taxonomy of cyber- harms: Defining the impacts of cyber-attacks and understanding how they propagate. Journal of Cybersecurity, 4(1), Vol. 4, Issue 1, pp. 1 - 4.
Al-Mhiqani, M. N., Ahmad, R., Zainal Abidin, Z., Yassin, W., Hassan, A., Abdulkareem, K. H., & Yunos, Z. (2020). A review of insider threat detection: Classification, machine learning techniques, datasets, open challenges, and recommendations. Applied Sciences, 10(15), 5208, 1-41.
Aslan, Ö., Aktuğ, S. S., Ozkan-Okay, M., Yilmaz, A. A., & Akin, E. (2023). A comprehensive review of cyber security vulnerabilities, threats, attacks, and solutions. Electronics, 12(6), 1333. Pp 1-42. https://doi.org/10.3390/electronics12061333
Balakrishnan, B. (2015). Insider threat mitigation guidance. Retrieved from: https://www.sans.org/reading-room/whitepapers/monitoring/insider-threat-mitigation-guidance-36307.
Bedford, J. (2018). Organisational vulnerability to intentional insider threat. (Doctoral dissertation, University of Southern Queensland). https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=Organisational+vulnerability+to+intentional+insider+threat&btnG= Accessed 24 July, 2024.
Boakye-Gyan, K. (2021). An Approach to a Comprehensive Framework for Insider Threat (Doctoral dissertation, Capitol Technology University).
Bilusich, D. A. N. I. E. L., Chim, L. E. U. N. G., Nunes-Vaz, R. A., & Lord, S. (2018). There is no single solution to the ‘insider’problem but there is a valuable way forward. WIT Transactions on Engineering Sciences, 121, 135-146.
Cappelli DM, Moore AP & Trzeciak RF (2012). The CERT guide to insider threats: how to prevent, detect, and respond to information technology crimes (theft, sabotage, fraud). https://scholar.google.com/scholar?q=The+CERT+guide+to+insider+threats:+how+to++prevent,+detect,+and+respond+to+information+technology+crimes+(theft,+sabotage,+fraud).&hl=en&as_sdt=0,5.
Chauhan, K. (2024). Insider Threats Mitigation: Role of Penetration Testing. arXiv preprintarXiv:2407.17346. https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=Insider+Threats+Mitigation%3A+Role+of+Penetration+Testing&btnG=. Accessed June 26, 2025.
Clea Ostendorf (2023), 11 Real-Life Insider Threat Examples, https://www.code42.com/blog/insider-threat-examples-in-real-life/ assessed on May 20, 2024
Clifton, A. (2024). Strategies for Insider Threat Mitigation and Detection (Doctoral dissertation, Walden University).
Dacorogna, M., & Kratz, M. (2023). Managing cyber risk, a science in the making. Scandinavian Actuarial Journal, 2023(10), 1000-1021. https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=Managing+cyber+risk%2C+a+science+in+the+making&btnG=.
Dorrington, M. (2018). Future insider threats: A Delphi analysis (Doctoral dissertation). Available from ProQuest (Accession No. 13427366).
Farnham, S. D. (2018). "Evaluating the Impact of Security Training on Employee Behaviour." Information Systems Security, 27(2), 175-186.
Frangopoulos, ED, Eloff, MM & Venter, LM (2013). 'Psychosocial risks: can their effects on the security of information systems really be ignored?', Information Management and Computer Security, Vol. 21, No. 1, pp. 53-65.
Gamachchi, A., Sun, L., & Boztas, S. (2018). A graph-based framework for malicious insider threat detection. arXiv preprint arXiv:1809.00141. https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=A+Graph+Based+Framework+for+Malicious+Insider+Threat+Detection&btnG=, accessed on May 15, 2025.
Gelles, MG (2016). Insider Threat: Prevention, Detection, Mitigation, and Deterrence, Butterworth-Heinemann, US. https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=Insider+Threat%3A+Prevention%2C+Detection%2C+Mitigation%2C+and+Deterrence&btnG=. Accessed August 15, 2024.
Global cybersecurity outlook (2022) insight report,https://www3.weforum.org/docs/WEF_Global_Cybersecurity_Outlook_2022. Accessed on June 24, 2024.
Greitzer, F. L. (2019). Insider threats: It’s the HUMAN, stupid! NCS ’19: Proceedings of the Northwest Cybersecurity Symposium, 1–8. doi:10.1145/3332448.3332458
Haran, M. H. (2016). Framework Based Approach for the Mitigation of Insider Threats in E-governance IT Infrastructure. International Journal of Scientific Research, 3(4), 5-10.
Hoffmann, R., Napiórkowski, J., Protasowicki, T., & Stanik, J. (2020). Risk based approach in scope of cybersecurity threats and requirements. Procedia Manufacturing, 44, 655-662.
Holger, S. (2023). Insider Threat Report, https://nationalcioreview.com/wp-content/uploads/2024/07/2023_Insider_Threat_Report-16d8d8f7.pdf, accessed on June 15, 2024.
Homoliak, I., Toffalini, F., Guarnizo, J., Elovici, Y., & Ochoa, M. (2019). Insight into insiders and it: A survey of insider threat taxonomies, analysis, modeling, and countermeasures. ACM Computing Surveys (CSUR), 52(2), 1-40.
Humayun, M., Niazi, M., Jhanjhi, N. Z., Alshayeb, M., & Mahmood, S. (2020). Cyber security threats and vulnerabilities: a systematic mapping study. Arabian Journal for Science and Engineering, 45, pp. 3171-3189.
Inayat, U., Farzan, M., Mahmood, S., Zia, M. F., Hussain, S., & Pallonetto, F. (2024). Insider threat mitigation: Systematic literature review. Ain Shams Engineering Journal, 103068. Accessed on May 15, 2025.
Kauh, J., Lim, W., Kwon, K., Lee, J. E., Kim, J. J., Ryu, M., & Cha, S. H. (2017). Indicator-based behaviour ontology for detecting insider threats in network systems. KSII Transactions on Internet and Information Systems (TIIS), 11(10), 5062-5079.
Liang, NP & Biros, D (2016). 'Validating common characteristics of malicious insiders: Proof of concept study', 49th Hawaii International Conference on System Sciences (HICSS), Koloa, HI, USA, pp. 3716-3726.
Liu, L.; De Vel, O.; Han, Q.-L.; Zhang, J. & Xiang, Y. (2018). Detecting and Preventing Cyber Insider Threats: A Survey. IEEE Commun. Surv. Tutor. 1397–1417.
Liu, J. (2020). "The Impact of Cloud Computing on Insider Threats: A Comprehensive Review." Future Generation Computer Systems, 108, 146-155.
Maasberg, M. (2017). An empirical examination of insider threat revenge behaviours for analyzing high risk insiders exhibiting subclinical psychopathic traits (Doctoral dissertation. Retrieved from ProQuest Dissertations and Theses Global. (1906305261)).
Maasberg, M., Warren, J., & Beebe, N. L. (2015). The dark side of the insider: detecting the insider threat through examination of dark triad personality traits. In 2015 48th
Max Alexander, C. I. S. M., & CRISC, C. (2018). Protect, Detect and Correct Methodology to Mitigate Incidents: Insider Threats. https://www.isaca.org/resources/isaca-journal/issues/2018/volume-3/protect-detect-and-correct-methodology-to-mitigate-incidents-insider-threats. Accessed June 28, 2025.
Modini, J., Vanzomeren, M., Fowler, S., Joiner, K., & Lynar, T. (2020). Rising to the Challenge of Insider Threats for Middle Powers. Academic Conferences International Limited. 92 http://dx.doi.org/10.34190/ICCWS.20.131
Morrow, S. (2020). 8 of the world’s biggest insider threat security incidents. Retrieved January 22, 2021, from Infosec Resource https://resources.infosecinstitute.com/topic/8-of-the-worlds-biggest-insider-threatsecurity-incidents/
Mouton, F, Leenen, L & Venter, HS (2016). 'Social engineering attack examples, templates and scenarios', Computers and Security, Vol. 59, pp. 186-209.
Neumann, P. G. (2010). Combatting insider threats. In Insider Threats in Cyber Security (pp. 17-44). Boston, MA: Springer US.
Nurse, J. R. C., Buckley, O., Legg, P., Goldsmith, M., Creese, S., Wright G. & Whitty, M. (2014). Understanding insider threat: A framework for characterizing attacks. Retrieved from https://www.cs.ox.ac.uk/files/6576/writ2014_nurse_et_al.PDF.
Ponemon Cost of Insider Threats Global report, (2022). Viewed 26 July 2024). https://www.proofpoint.com/us/resources/threat-reports/cost-of-insider-threats
Pureti, N. (2022). Insider Threats: Identifying and Preventing Internal Security Risks. International Journal of Advanced Engineering Technologies and Innovations, 1(2), pp.98-132.
Rakhi, S., Sampada, H. K., Balodi, A., Shobha, P. C., & Kumar, R. (2025). Insider Threat Detection and Prevention: New Approaches and Tools. Emerging Threats and Countermeasures in Cybersecurity, 241-262.
Rama K. (2023). The Different Types of Insider Threats and How to Stop Them. https://www.google.com/url?sa=tandsource=webandrct=jandopi=89978449andurl=https://www.securonix.com/blog/stop-insider-threats. Viewed 31 August, 2024.
Saxena, N., Hayes, E., Bertino, E., Ojo, P., Choo, K. K. R., & Burnap, P. (2020). Impact and key challenges of insider threats on organizations and critical businesses. Electronics, 9(9), 1460.
Safa, NS, Maple, C, Watson, T & Von Solms, R (2018). 'Motivation and opportunity-based Model to reduce information security insider threats in organisations', Journal of Information Security and Applications, 40 (2018): pp. 247-257.
Shaw, ED & Sellers, L (2015). 'Application of the critical-path method to evaluate insider risks', Studies in Intelligence, vol. 59, no. 2, pp. 1-8, viewed 01 September 2015,
Singleton, C. (2021). X-force threat intelligence index (Tech. Rep.). Armonk, NY: IBM. https://www.cybersecurity-insiders.com/portfolio/2023-insider-threat-report-gurucul/
Sokolowski, J & Banks, C (2015). 'Agent implementation for modeling insider threat', Winter Simulation Conference (WSC), 06-09 December 2015, Huntington Beach, CA, USA, pp. 266-275.
Subhani, A., Khan, I. A., & Zubair, A. (2021). Review of insider and insider threat detection in the organizations. Journal of Advanced Research in Social Sciences and Humanities, 6(4), 167-174.
Tang, M, Li, Mg & Zhang, T (2016). 'The impacts of organizational culture on information security culture: a case study', Information Technology and Management, Vol. 17, No. 2, pp. 179-186.
Tessian. (2021). The psychology of human error - tessian (Tech. Rep.). Broadgate Circle, UK:https://www.code42.com/blog/insider-threat-examples-in-real-life/
Tongkaw, A. (2019). Software defined network, the design, technique, and internet of things defined in campus network. International Journal of Technology and Engineering Studies, 5(3), 80–89. doi:https: //dx.doi.org/10.20469/ijtes.5.10002-3.
Vashisth, A and Kumar, A (2013). 'Corporate espionage: the insider threat', Business Information Review, Vol. 30, No. 2, pp. 83-90.
Waters, M. D. (2016). Identifying and preventing insider threats. https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=Identifying+and+Preventing+Insider+Threats&btnG=. Accessed June 28, 2025.

Find the perfect home for your research! If this journal isn't the right fit, don't worry—we offer a wide range of journals covering diverse fields of study. Explore our other journals to discover the ideal platform for your work and maximize its impact. Browse now and take the next step in publishing your research:

| HOME | Yasin | AlSys | Anwarul | Masaliq | Arzusin | Tsaqofah | Ahkam | AlDyas | Mikailalsys | Edumalsys | Alsystech | AJSTEA | AJECEE | AJISD | IJHESS | IJEMT | IJECS | MJMS | MJAEI | AMJSAI | AJBMBR | AJSTM | AJCMPR | AJMSPHR | KIJST | KIJEIT | KIJAHRS |