Caveats about Our Work

Organizations are often reluctant to report incidents of illicit insider cyberactivity, even to law enforcement. Therefore, the actual number of insider cases is most likely significantly greater than those that we have been able to identify. Our work is largely based on reported cases, although our assessments have exposed us to additional cases not reported to law enforcement. This limits the ability to generalize our findings to all organizations and underscores the difficulty other researchers have faced in trying to better understand insider threat. Nevertheless, this limitation does not diminish the value of the knowledge that we gained from analyzing these incidents. We provide insight into actual criminal and other illicit acts committed by insiders. This insight has been found to be quite useful to individuals who are charged with protecting critical assets as they begin to examine ways to improve their defenses against insider threats.