Nearly one in three UK organizations identify malicious insiders as a leading cause of data breaches

According to Apricorn's 2026 research, 29% of UK organizations identify employees with malicious intent as one of the leading causes of data breaches, compared with 19% in the US.

The findings raise an important question for CISOs and security teams: If insider risk is already recognized as a major security concern, how much of it can existing security tools actually identify?

Insider risk isn't always what it appears to be

Insider risk is often associated with employees deliberately misusing their access. But the reality is more complex.

A UK government study of more than 120 insider cases, published in 2013, found that only 6% involved individuals who joined an organization intending to exploit their access. In 76% of cases, the activity was self-initiated after employment had begun.

External pressure can add another dimension. Criminal groups may recruit or coerce individuals who already have legitimate access to sensitive systems and information.

This matters because trusted access can create vulnerabilities that are difficult to identify through conventional security monitoring. An employee may use authorized credentials and follow established workflows while circumstances outside the organization's visibility introduce additional risk.

Compromising material creates a different kind of exposure

One particularly overlooked area of human insider risk involves compromising material that could make an individual more susceptible to coercion.

In the Verizon Data Breach Investigations Report 2026, NetClean contributed research based on nearly 270,000 enterprise devices. The findings showed that approximately one in 500 employees had accessed high-risk or compromising material on a corporate device.

Such material can potentially be used as leverage against someone with legitimate access to corporate systems. The concern is not that encountering this material automatically indicates malicious intent, but that it may introduce a vulnerability that traditional security controls are not designed to recognize.

This is part of a wider visibility challenge. Apricorn's US research found that 49% of respondents said their organization became involved in breach reporting after someone else reported the incident, compared with 12% in 2025. Meanwhile, Ponemon Institute's 2026 Cost of Insider Risks Global Report found that organizations took an average of 67 days to contain an insider incident.

Although these findings measure different aspects of insider risk, they highlight the difficulties organizations face in gaining timely visibility and responding effectively.

Traditional security technologies provide extensive insight into malware, compromised credentials, unauthorized access, and data movement. But they are not necessarily designed to identify known high-risk content associated with certain forms of human insider risk.

Closing the visibility gap with verified intelligence

Addressing this gap doesn't mean replacing existing security investments. It means adding specialized intelligence to the tools and workflows organizations already use.

Verified Risk Indicators, such as cryptographic file hashes, URLs, and domains, allow security teams to identify matches associated with specific Risk Domains.

File hashes already collected through EDR, DLP, SIEM, or forensic tools can be checked against verified File Risk Indicators. Similarly, verified Web Risk Indicators can be used within existing DNS, SASE, SSE, and web security controls.

This privacy-first approach focuses on known, verified indicators rather than broad monitoring of employee content or behavior. A match identifies a verified Risk Indicator, providing additional context for assessment. It does not establish an individual's intent or determine whether an incident has occurred.

Results can support existing SOC, SIEM, and SOAR workflows, allowing organizations to combine specialized intelligence with the technical and organizational information already available.

For UK security leaders, the implications of Apricorn's findings are clear. Recognizing insider risk is important, but understanding where existing security controls have limited visibility is equally critical.

Further reading:

• How the same risk plays out with child sexual abuse material in the public sector
• When extremist content becomes an insider risk
• Talk to NetClean