← Back to Blog Cybersecurity

The Threat You're Not Watching: Insider Attacks in 2025

During a post-incident investigation for a professional services firm, we discovered a departing employee had spent their final two weeks exfiltrating the company's entire client database to a personal Dropbox. The company didn't notice until a competitor called six weeks later.

Insider threats are uncomfortable to discuss - they imply distrust. But the data is unambiguous: insider incidents account for a large share of all data breaches and are consistently the most expensive to resolve, partly because they're the hardest to detect.

Three Types of Insider Threats

Malicious insiders intentionally steal data, sabotage systems, or sell access. Often triggered by termination, grievance, or financial pressure. They're the hardest to detect because they're using legitimate access to do legitimate-looking things.

Negligent insiders cause breaches through carelessness - clicking phishing links, emailing sensitive files to personal accounts, or misconfiguring a system. No bad intent, real damage.

Compromised insiders are employees whose credentials were stolen. The attacker operates entirely within the footprint of a real user account - making their activity nearly indistinguishable from normal behavior.

A Real Finding: Exfiltration via Cloud Storage (OWASP A09 - Security Logging and Monitoring Failures)

In the investigation above, the employee uploaded 4.2GB over 14 days to personal Dropbox. The activity was completely invisible because the company had no DLP controls and no outbound traffic monitoring:

# What forensic reconstruction of proxy logs showed (simplified)
# 847 POST requests over 14 business days
# All during normal business hours from the office network
# All to content.dropboxapi.com  -  personal account token

POST https://content.dropboxapi.com/2/files/upload
Authorization: Bearer dAAAAAA[personal_token_redacted]
Dropbox-API-Arg: {{"path": "/client_export_final.csv","mode":"overwrite"}}
Content-Length: 8421376

# Total exfiltrated: 4.2GB across 847 requests
# Without proxy logging: completely invisible

# What forensic reconstruction of proxy logs showed (simplified)
# 847 POST requests over 14 business days
# All during normal business hours from the office network
# All to content.dropboxapi.com  -  personal account token

POST https://content.dropboxapi.com/2/files/upload
Authorization: Bearer dAAAAAA[personal_token_redacted]
Dropbox-API-Arg: {{"path": "/client_export_final.csv","mode":"overwrite"}}
Content-Length: 8421376

# Total exfiltrated: 4.2GB across 847 requests
# Without proxy logging: completely invisible

With basic outbound proxy logging and a DLP rule blocking uploads to personal cloud storage from managed devices, this would have been caught on day one.

What Actually Works

1. Least privilege. People access only what their specific role requires. Audit permissions every quarter.
2. Immediate offboarding. Revoke all access the moment notice is given - not on their last day, not the following week.
3. Behavioral monitoring. Alert on large downloads outside normal hours, bulk email forwards, or access to systems outside the normal role.
4. DLP controls. Block or alert on uploads to personal cloud storage (Dropbox, Google Drive, etc.) from managed corporate devices.

The firm recovered their data through legal action. The client relationships took much longer.