Nearly one in three UK organizations identifies malicious insiders as a leading cause of data breaches

NetClean

malicious insiders as a leading cause of data breaches

New research shows how many UK security leaders see the threat inside their own organization. But can existing security tools see what matters?

According to Apricorn's 2026 survey of 200 UK and 200 US IT security decision-makers, 29% of UK organizations identify employees with malicious intent as one of the leading causes of data breaches, compared with 19% in the US.

If insider risk is already recognized as a major security concern, how much of it can existing security tools actually identify?

Most insider risk takes shape after someone is hired

A UK government study of more than 120 insider cases, published in 2013, found that only 6% involved individuals who joined an organization intending to exploit their access. In 76% of cases, the activity was self-initiated after employment had begun.

Pressure from outside adds to this. Jon Fielding, Managing Director EMEA at Apricorn, says that "organised criminal groups are increasingly recruiting insiders to steal sensitive data or provide privileged access."

Trusted access can create vulnerabilities that are difficult to identify through conventional security monitoring. An employee may use authorized credentials and follow established workflows while circumstances outside the organization's visibility introduce additional risk.

Trusted access can create vulnerabilities that are difficult to identify through conventional security monitoring.

Compromising material makes trusted employees easier to coerce

In the Verizon Data Breach Investigations Report 2026, NetClean contributed research based on nearly 270,000 enterprise devices. The findings showed that approximately one in 500 employees had handled compromising or high-risk material on a corporate device.

Such material can be used as leverage against someone with legitimate access to corporate systems. That can create a vulnerability regardless of the person's intent, and traditional security controls are not designed to recognize this type of risk.

Many organizations learn about a breach from someone else

Apricorn's US research found that 49% of respondents said their organization became involved in breach reporting after someone else reported the incident, compared with 12% in 2025. Meanwhile, Ponemon Institute's 2026 Cost of Insider Risks Global Report found that organizations took an average of 67 days to contain an insider incident.

The Apricorn figure covers breaches in general and the Ponemon figure covers insider incidents. Both show how hard it is for organizations to spot problems in time and respond effectively.

Traditional security technologies provide extensive insight into malware, compromised credentials, unauthorized access, and data movement. But they are not necessarily designed to identify known high-risk content associated with certain forms of human insider risk.

Organizations take an average of 67 days to contain an insider incident.

Verified indicators can flow into the security tools you already run

Addressing this gap means adding specialized intelligence to the tools and workflows organizations already use, without replacing existing security investments.

Verified Risk Indicators, such as cryptographic file hashes, URLs, and domains, allow security teams to identify matches associated with specific Risk Domains.

File hashes already collected through EDR, DLP, SIEM, or forensic tools can be checked against verified File Risk Indicators. Similarly, verified Web Risk Indicators can be used within existing DNS, SASE, SSE, and web security controls.

This privacy-first approach focuses on known, verified indicators rather than broad monitoring of employee content or behavior. A match identifies a verified Risk Indicator, providing additional context for assessment. It does not establish an individual's intent or determine whether an incident has occurred.

Results can support existing SOC, SIEM, and SOAR workflows, allowing organizations to combine specialized intelligence with the technical and organizational information already available.

UK security leaders are already looking inward

Nearly one in three UK organizations already ranks malicious insiders among the leading causes of data breaches. The next question is which risk indicators the current security stack cannot see.

NetClean ProActive is a Human Insider Risk Intelligence Platform that adds specialized intelligence to existing security environments. It covers two Risk Domains: child sexual abuse material (CSAM), through File and Web Risk Indicators, and terrorist and violent extremist content (TVEC), through Web Risk Indicators. Through Detection Services, Analysis Services, and Intelligence Services, ProActive helps organizations identify verified matches and bring additional intelligence into existing security workflows. ProActive also offers a Splunk connector and integration options for Microsoft Defender, Sentinel, and Purview.

NetClean provides the intelligence and context. The organization determines the appropriate investigation and response.