Insider Risk Programs: How Companies Protect Their Secrets From the People Who Already Have the Keys

Hand swiping an access card at an office door, representing an insider risk program — Insiders already have the keys; an insider risk program decides what they can reach. Photo: Envato.

Every company’s most sensitive information is already in the hands of people it trusts. Most of them will never cause harm. A few will, through malice, carelessness, or because someone outside found a way to recruit them. The U.S. Cybersecurity and Infrastructure Security Agency defines insider threat as “the potential for an insider to use their authorized access or understanding of an organization to harm that organization” (CISA). That makes insider risk a strategic intelligence problem, not only an IT or HR problem.

This page explains what insider risk is, what government guidance says to watch for, how outsiders recruit insiders, why the weeks around a resignation matter, and what an insider risk program should cover if it is to work without trampling employee privacy or sliding into profiling. It is part of a series on corporate counterintelligence. It is general guidance drawn from public sources, not legal or security advice for a specific case; any company designing or acting on a program should talk to employment and privacy counsel.

Insider risk at a glance

Who counts as an insider: “any person who has or had authorized access to or knowledge of an organization’s resources” (CISA), including former employees, contractors, and vendors.
Three broad types: malicious insiders, negligent or accidental insiders, and collusive insiders who “collaborate with an external threat actor” (CISA).
Most incidents are not malicious: a 2025 Ponemon Institute survey of 349 organizations attributed 55 percent of insider incidents to negligence or mistakes, 25 percent to malicious insiders, and 20 percent to insiders whose credentials were stolen; the average annual cost was $17.4 million (Ponemon Institute and DTEX, via SecurityInfoWatch).
Public guidance: CISA’s Insider Threat Mitigation Guide, revised on September 9, 2026 (Infosecurity Magazine); Carnegie Mellon’s Common Sense Guide to Mitigating Insider Threats; and the National Insider Threat Task Force, which the National Counterintelligence and Security Center co-leads with the FBI (NCSC).
The departure window: CERT researchers found that “many insiders who stole IP did so within 30 days of their termination” (CERT, Carnegie Mellon).
The guardrail: “insider threat programs target anomalous activities, not individuals” (NCSC).

What insider risk is

CISA’s four stages of insider threat mitigation for an insider risk program: define, detect and identify, assess, manage — CISA’s public four-stage framework. Chart: Competitive Futures.

Government guidance has been moving from “insider threat” toward “insider risk.” The United Kingdom’s National Protective Security Authority adopted new definitions in May 2023: insider risk is “the likelihood of harm or loss to an organisation, and its subsequent impact,” from an insider’s action or inaction, intentional or not (NPSA). “Threat” suggests a villain to catch. “Risk” describes a condition to manage, and it covers the far more common case of a well-meaning employee who sends the wrong file.

The categories call for different responses. Malicious insiders act “to harm an organization for personal benefit or to act on a personal grievance” (CISA): the engineer who takes designs to a startup, or the salesperson who leaves with the customer list. Negligent and accidental insiders expose the company “through carelessness” or by mistake; training, good defaults, and simpler systems help more than investigations. Recruited or collusive insiders work with a competitor, a criminal group, or a foreign service, and third parties such as contractors and vendors carry the same risks (CISA). This is where insider risk meets counterintelligence: the insider may be the last link in an operation that began far outside the building.

What government guidance says to watch for, and why indicators are not proof

Public guidance agrees on one encouraging finding: insider harm is rarely a bolt from the blue. CISA notes that malicious insider acts are “rarely spontaneous” and that detection relies on “observable, concerning behaviors or activities” (CISA). The government’s Safeguarding Science materials say that “most insider threats exhibit risky behavior prior to committing negative workplace events” (NCSC).

The published indicators fall into broad families: technical activity, such as unusual downloads or transfers to personal accounts; workplace conduct, such as concealment or undisclosed outside work; and personal stressors, such as grievances or financial strain. CISA and CERT describe them in detail; companies should take their indicator language from those sources. In nearly every case below, the decisive evidence was data moved somewhere it did not belong.

The same guidance carries a warning. CISA observes that most people who face stress “do so without resorting to disruptive or destructive acts” (CISA). Debt, divorce, and long hours describe a large share of any workforce. When federal insider threat training expanded in 2013, reporting noted that a 2008 National Research Council review had found no consensus on whether behavior-detection techniques were “ready for use” (Government Executive), and the Defense Contract Management Agency tells its workforce that “unwarranted suspicion should be avoided” (DCMA). An indicator is a reason to look more closely, never a verdict.

How competitors and foreign services recruit insiders

Intelligence officers summarize why people betray their employers with the mnemonic MICE: money, ideology, coercion or compromise, and ego (The Conversation). In business, money, often a job offer or startup equity, is the most common lever.

USB drive plugged into a laptop, a common data exfiltration path an insider risk program watches for — Removable media and personal cloud accounts recur in insider cases. Photo: Envato.

The FBI warns that foreign governments sponsor “talent plans,” with China the most prolific sponsor. It notes that “participating in talent plans is not inherently illegal,” but that plans “usually involve undisclosed and illegal transfers of information, technology, or intellectual property” (FBI). For a company, the hidden conflict, an undisclosed second employer or startup, is often the clearest signal. Approaches to travelers are covered on the travel security page.

The departing-employee window

The period around a resignation is the most consistent pattern in public insider cases; CERT found that many intellectual property thefts happened within 30 days of the insider leaving (CERT, Carnegie Mellon). The answer in public guidance is not suspicion of everyone who gives notice, but a consistent offboarding process for every departure. How that relates to the legal requirement of “reasonable measures” is on the trade secrets page.

What an insider risk program should cover

Public guidance converges on a short list. CISA’s guide organizes the work into detecting, assessing, and managing the threat, scaled to an organization’s size (CISA), and CERT’s Common Sense Guide sets out widely used best practices (Software Engineering Institute). At a high level, a program brings HR, legal, security, and IT together; focuses on the information that matters most; publishes clear policies; keeps any monitoring proportionate and lawful; and builds a culture in which people trust that reports will be handled fairly. U.S. employers should also confirm with counsel that their agreements include the Defend Trade Secrets Act whistleblower notice (18 U.S.C. § 1833(b)). Monitoring rules differ widely by country; the UK regulator says monitoring “must be necessary, proportionate and respect the rights of workers” (ICO).

Avoiding overreach and bias

A program that focuses on who people are rather than what they do will fail on fairness, law, and effectiveness. When the Justice Department ended its “China Initiative” framework in February 2022, the head of its National Security Division said it had “helped give rise to a harmful perception” of a lower standard for China-related conduct, while stressing “the evolving, significant threat that the government of China poses” (Justice Department).

Both halves hold for companies. Foreign services and competitors do recruit insiders, but national origin, ethnicity, and family ties are not indicators of misconduct, and treating them as such can break the law, drive away talent, and blind investigators to the insider who fits no stereotype. Cognitive biases such as confirmation bias deserve the same vigilance.

Cases that show the risk

Anthony Levandowski and Google (2020)

Anthony Levandowski, who helped lead Google’s self-driving car project and later joined Uber, pleaded guilty in March 2020 to one count of trade secret theft and was sentenced that August to 18 months; the judge called it “the biggest trade secret crime I have ever seen” (Justice Department). He was pardoned in January 2021 (Fortune). The legal history is on our Economic Espionage Act page. Lesson: a senior insider moving to a competitor is a high-value risk, and pre-departure downloads are where the evidence lives.

Xiaolang Zhang and Apple (2018–2024)

Xiaolang Zhang, a hardware engineer on Apple’s autonomous vehicle project, resigned after leave and a trip to China to join a Chinese autonomous-driving company. Apple’s review found database downloads and video of him removing circuit boards and a server from labs, and he was arrested in 2018 at San Jose’s airport before a flight to China (CNBC). He pleaded guilty in August 2022 and was sentenced in February 2024 to 120 days in prison and about $147,000 in restitution (Bloomberg Law; Engadget). Lesson: the resignation triggered the review that found the evidence.

Klaus Pflugbeil and an electric vehicle maker (2024)

Klaus Pflugbeil and a co-defendant were former employees of a Canadian battery-equipment maker that a U.S. electric vehicle company bought in 2019; press reports identified the buyer as Tesla (Fortune). Prosecutors said the pair built a China-based business on the acquired company’s battery-assembly trade secrets. Undercover agents met the co-defendant at a Las Vegas trade show in 2023, and Pflugbeil later sent them a proposal containing the victim’s drawings. He pleaded guilty in June 2024 and was sentenced on December 16, 2024, to 24 months; the co-defendant remained at large (Justice Department). Lesson: insiders include former employees of companies you acquire, and their knowledge does not expire at closing.

Chenguang Gong and a defense research company (2023–2025)

Chenguang Gong, a chip-design manager at a Los Angeles-area research company that develops infrared sensor technology used to detect and track missiles (CBS News), was hired in January 2023 and terminated that April. He moved more than 3,600 files to personal devices, more than 1,800 of them after accepting a job with a main competitor; prosecutors said he had applied to Chinese government talent programs between 2014 and 2022. He pleaded guilty to theft of trade secrets and was sentenced on November 17, 2025, to 46 months (Justice Department). Lesson: in defense and industrial research, the first months and the last weeks of employment both deserve attention.

Linwei Ding and Google (2024–2026)

Former Google engineer Linwei Ding uploaded hundreds of AI infrastructure files to a personal cloud account while, prosecutors said, secretly founding a China-based startup; another employee scanned his badge to make it appear he was at the office while he was in China (NBC News). A jury convicted him in January 2026 of economic espionage and trade secret theft (CBS News). In August 2026 the judge vacated the economic espionage counts for insufficient evidence that Ding intended to benefit the Chinese government, leaving the theft convictions (The Next Web), and on September 1, 2026, sentenced him to just under a year in prison (KQED). Lesson: undisclosed outside roles and data moved to personal accounts were the core facts.

What it means for companies

Insider risk is an enterprise risk, and it deserves an executive owner and a cross-functional team. The free public guidance from CISA and CERT is a sound starting point. Clear disclosure rules surface conflicts early, consistent exits close the most common window, and fairness, with HR and counsel involved and attention on conduct rather than identity, keeps the program lawful and trusted. Most incidents are mistakes, so training and good system design prevent more loss than investigations do.

How intelligence and foresight help anticipate who will target you

An insider risk program looks inward. It works better paired with an outward view of who wants what the company has and why: a rival that has fallen behind, a foreign state that has named the technology a national priority, or an investor building a competing venture. Tracking those motives as markets, regulation, and geopolitics shift tells a company which assets and roles are likely to attract attention next. That is the territory of intelligence analysis and strategic foresight, and it turns insider risk from a reactive control into an anticipatory one.

Cardboard box of office belongings with a resignation notice, representing departing-employee risk in an insider risk program — The weeks around a resignation are when many insider thefts happen. Photo: Envato.

Frequently asked questions

What is the difference between insider threat and insider risk?

“Insider threat” usually means the potential for a person with access to cause harm. “Insider risk” is the broader likelihood of harm or loss from insiders, intentional or not. The U.K.’s National Protective Security Authority adopted insider risk language in May 2023 (NPSA), and many companies prefer it because it covers mistakes and sounds less accusatory.

Do behavioral indicators mean someone is stealing?

No. Indicators are reasons to look more closely, not proof; CISA notes that most people under stress never cause harm (CISA). Concerns should be assessed against facts by a cross-functional team, with counsel involved before any adverse action.

Is it legal for a company to monitor employees for insider risk?

Often, within limits that vary by country and state. U.K. guidance requires monitoring to be necessary, proportionate, and transparent (ICO), and U.S. employers face federal labor law and state privacy rules. Talk to employment and privacy counsel first, and tell employees what is monitored and why.

Is joining a foreign talent program illegal?

Not in itself. The FBI says participation “is not inherently illegal,” but participants may violate U.S. law, particularly through undisclosed transfers of information (FBI). For employers, the practical issue is disclosure: a clear conflict-of-interest policy lets the company evaluate outside commitments openly.

Does a small or mid-sized company need an insider risk program?

Yes, scaled to its size. CISA designed its guide to scale with an organization’s maturity and size (CISA). For a smaller company, that may mean a few clear policies, access controls on key information, a standard exit process, and named people in HR, legal, and IT who handle concerns together.