The most common and costliest insider threat isn't malice - it's carelessness. Employees who share passwords, click phishing links, misconfigure systems, or fall for social engineering hand attackers the keys to the kingdom without ever knowing it.
Dear Jennifer,
Our security systems have detected unusual login activity on your account from an unrecognized device in Lagos, Nigeria.
To protect your account, you must verify your identity within 24 hours or your access will be permanently suspended.
Please click below to verify your identity immediately:
If you believe this is an error, contact your IT department or click here to dismiss.
Before sending a single email, the attacker researches their target. OSINT gathering from LinkedIn, company websites, and data broker sites reveals employee names, roles, reporting structures, and email formats - enabling hyper-personalized lures.
The phishing email lands in Jennifer's inbox on a busy Monday morning. It bypassed spam filters because the domain was freshly registered, the email was sent via a reputable relay, and it passed SPF/DKIM checks on its own domain.
URGENT: Your account will be disabled in 24 hours due to suspicious login from Nigeria.
Click to verify identity: company-secure-portal.com/verify
This looks real... the IT team does send these security alerts. And they used my name. I don't want my account suspended before the board meeting today.
You have 23 hours and 58 minutes remaining to verify before account suspension. Act now.
Okay, I'll just quickly verify... I can ask IT about it later if needed.
[clicks the link]
Jennifer lands on a pixel-perfect replica of the company's Microsoft 365 login page. The site has a valid HTTPS certificate (green padlock) - which only proves the connection is encrypted, not that the site is legitimate. She enters her credentials.
In parallel or as an alternative, attackers use voice phishing (vishing) - calling employees while impersonating IT support. The social pressure of a live conversation is highly effective: most people find it harder to say no to a person than to ignore an email.
Hi Jennifer, this is David from IT Security. I'm calling because our systems flagged your workstation with a critical ransomware alert. I need to help you remotely right now before it spreads to the file server.
Oh no - really? David always calls when there's an issue... Okay, what do I need to do?
I've sent you a password reset code via text. Can you read that back to me so I can authenticate the remote session? We need to act in the next 2 minutes.
It says... 847291. Is that what you need?
Perfect, thank you Jennifer. All sorted. You'll get a confirmation email shortly. Great job acting quickly!
With Jennifer's session token and credentials, the attacker logs in as her from an anonymous VPN. They now have access to everything Jennifer can access - email, SharePoint, HR systems, payroll, and any SSO-connected applications - without triggering additional alerts.
HR access is a goldmine for lateral movement. Employee records contain SSNs, banking details, and - critically - every other employee's email address and manager relationship. The attacker uses Jennifer's trusted position to pivot to higher-value targets.
Weeks after the initial click, the breach is discovered - often not by security tools but by Jennifer herself noticing odd emails, or by finance flagging the fraudulent wire transfer. By then, months of email have been exfiltrated and the attacker has long since covered their tracks.