Insider Threats Up Sevenfold: A UK CISO Checklist for 2026

UK insider threat incidents rose sevenfold in early 2026, so CISOs must pair access controls with a formal, board-owned detection and response programme. According to the Identity Theft Resource Center (ITRC), UK and global organisations logged 21 insider wrongdoing events in the first half of 2026 alone — as many as the whole of 2025, seven times over — driven largely by tech-sector layoffs and nation-state recruitment schemes targeting disgruntled or departing staff.

What Is Driving the Sevenfold Rise in UK Insider Incidents?

Three forces are converging. First, redundancy and restructuring activity has left more employees with access to sensitive systems during their notice period than at any point since 2020 — exactly the window in which the ITRC’s tracked cases cluster. Second, nation states are actively recruiting insiders at technology, defence and financial services firms, offering payment for credentials or data rather than relying solely on external intrusion. Third, according to the DSIT Cyber Security Breaches Survey 2025/2026, 43% of UK businesses reported a breach or attack in the past year, and a growing share of these now involve someone who already had legitimate access rather than an external attacker breaking in.

UK financial services firms carry above-average exposure: sector analysis from the Association of British Insurers’ Cyber Resilience Committee puts insider involvement at roughly 29% of EMEA breaches, higher than the global average. For CISOs already managing third-party and supply chain risk, insider exposure compounds the problem — contractors and outsourced staff often sit inside the same privileged-access blind spot as permanent employees.

Executive Action

• Cross-reference every redundancy, restructuring or M&A workforce change against a privileged access review, not just an HR exit checklist.
• Brief the board that insider risk is now a standing agenda item, not an HR-only concern — link it to your existing risk appetite statement.
• Use INFORMD’s cybersecurity assessment tools to baseline current insider risk exposure across business units.

Why Do Most UK Organisations Miss Insider Threats Until It’s Too Late?

Visibility is the core failure. Industry research consistently finds that a large majority of organisations lack full visibility into how employees handle sensitive data across endpoints, cloud drives and SaaS applications — meaning most insider activity is only discovered after data has already left the building. The 2026 Insider Threat Report from Cybersecurity Insiders found that just 8% of employees account for roughly 80% of security incidents, and that three-quarters of insider incidents are non-malicious: around 55% from carelessness or mistakes, and 20% from external actors misusing legitimate employee credentials rather than deliberate insider sabotage.

The good news is containment is improving: the average time to contain an insider incident fell to 67 days in 2026, down from 81 days in 2025. That improvement tracks closely with organisations that have already invested in identity controls — the same foundation CISOs are building for zero trust architecture. Insider threat detection and zero trust are not separate programmes; a well-instrumented identity and access layer is the control that catches both.

Executive Action

• Deploy user and entity behaviour analytics with defined baselines, prioritising the small population of high-privilege accounts responsible for most risk.
• Require same-day access revocation triggered automatically by HR offboarding events — not a manual, multi-day process.
• Benchmark your own containment time against the 67-day industry average and report the gap to the audit or risk committee.

What Should a UK CISO’s Insider Threat Programme Include?

On 9 September 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) updated its Insider Threat Mitigation Guide with new case studies and guidance covering hybrid work, AI and adverse employee separations. Its four-stage model — plan, organise, execute, maintain — gives UK CISOs a ready-made structure: define priorities and policy (plan), assemble a cross-functional team spanning HR, Legal, IT and Security (organise), run detection and response operations (execute), and review the programme against emerging risks such as AI-assisted data exfiltration (maintain).

Access control failures remain the most common regulatory trigger. The ICO’s £14 million fine against Capita in October 2025 cited inadequate security operations centre staffing and poor administrator access controls as creating a foreseeable and avoidable risk — a finding that applies directly to insider exposure, not just external attack. UK CISOs should treat least-privilege enforcement and time-bound access reviews as compliance-grade controls under UK GDPR’s accountability principle, not optional hygiene.

Executive Action

• Stand up a cross-functional insider risk team spanning HR, Legal, IT and Security, following CISA’s plan-organise-execute-maintain model.
• Enforce least-privilege access with mandatory quarterly reviews, prioritising accounts touched during restructuring or M&A activity.
• Document the programme against a recognised framework so it stands up to ICO or auditor scrutiny.

How Should CISOs Brief the Board on Insider Risk in 2026?

Boards carrying director duties under the Companies Act 2006 and Corporate Governance Code oversight expect risk reported in business terms, not technical jargon. A quarterly insider risk paper should cover three metrics: the number of privileged accounts and how that has changed since the last report, average containment time against the 67-day benchmark, and the volume of high-risk departures (redundancies, contested exits, competitor moves) cross-checked against access revocation records. Framing insider risk this way lets the board see it as a managed, measurable exposure rather than an unquantifiable people problem.

CISOs should also tie insider risk explicitly to the organisation’s existing risk appetite statement, so a spike in high-risk departures or a widening access-review backlog triggers the same escalation path as any other material risk. Review INFORMD’s executive briefing library for further governance frameworks, or use our templates to structure the board paper itself.

Executive Action

• Report insider risk quarterly using three metrics: privileged account volume, containment time, and high-risk leaver count.
• Tie insider risk explicitly to the board’s existing risk appetite statement so spikes trigger automatic escalation.
• Use INFORMD’s board reporting templates to standardise the insider risk paper across reporting cycles.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library (/resources/) or access our free assessment tools (/tools-assessments/).

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.