Insider threat awareness — SY0-701

WHAT IT IS

An insider threat is the threat that an insider will use their authorized access, wittingly or unwittingly, to do harm to the security of organizational operations and assets, individuals, other organizations, or the nation (NIST SP 800-53 Rev. 5).

An insider is any person with authorized access to any organizational resource, including personnel, facilities, information, equipment, networks, or systems (NIST SP 800-53 Rev. 5, adapted from CNSSI 4009-2015).

---

Mental model

Think of it as an access paradox: the same authorization that makes someone productive is the mechanism through which harm occurs. The threat does not originate from someone breaking through a perimeter — it originates from someone who was already let through the door.

---

When to use it

The most common exam confusion is treating "insider threat" as synonymous with "malicious employee." The NIST definition explicitly includes both witting (intentional) and unwitting (unintentional) actors. The table below captures the boundary:

Scenario	Insider threat?	Key criterion
Employee deliberately exfiltrates data to a competitor	Yes — witting	Authorized access used intentionally to cause harm
Employee clicks a phishing link and exposes credentials	Yes — unwitting	Authorized access used unintentionally to cause harm
External attacker exploits a public-facing server	No	No authorized access involved
Contractor accidentally misconfigures a shared drive	Yes — unwitting	Authorized access; harm is unintentional
Former employee uses a revoked credential	Depends on timing	Once access is revoked, the authorized-access criterion may not apply

The deciding question is always: did the actor have authorized access at the time of the harmful action?

---

COMMON MISCONCEPTION

The trap: Candidates often assume that "insider threat" requires intent to cause harm. The NIST definition (SP 800-53 Rev. 5) explicitly states the harm can occur wittingly or unwittingly — meaning a well-meaning employee who accidentally enables unauthorized disclosure is still acting as a source of insider threat. Filtering out "accidents" or "honest mistakes" from the definition is the specific error the exam can exploit.

A related trap is equating "insider" with "employee." NIST's definition in SP 800-53 Rev. 5 covers any person with authorized access — which can include contractors, vendors, or other third parties operating inside the authorization boundary.

---

How it shows up on the exam

The cognitive target here is recognizing the scope of the insider threat definition — specifically whether intent is required, and whether the actor must be a full-time employee.

Candidates should be alert to scenarios that describe:

• An employee who inadvertently leaks sensitive data (still qualifies as an insider threat source)
• A third-party contractor with system access who causes harm (still an insider under the authorized-access definition)
• Questions framing the contrast between an insider threat and an external threat — the distinguishing factor is authorized access, not malice

Because awareness is distinct from training — NIST SP 800-50 defines awareness as focused on helping individuals recognize security concerns and respond accordingly, rather than building deep skills — exam questions in this domain often test whether a candidate understands that insider threat awareness is about recognition and behavioral vigilance, not technical remediation skills.

---

Related concepts

• Security Awareness Training — the program that equips insiders to recognize threats, including threats they themselves might unintentionally pose
• Phishing Simulation — a practical tool for testing whether insider awareness extends to recognizing social-engineering attempts
• Security Governance — the policy and oversight layer under which insider threat programs operate within Domain 5