Cyber Resilience
Insider threats: the types UK regulated firms must control
Seven insider types, from careless staff to AI agents with delegated access, each matched to a control a UK regulated firm already runs.
Key takeaways
An insider threat is the misuse of legitimate access, deliberate or accidental, by staff, contractors, suppliers or AI agents acting on delegated access. UK regulated firms should control seven types, each with a control they already run under ISO 27001. Staff fraud is financial crime under the FCA's SYSC 6.1.1R, and any monitoring must follow the ICO's guidance on monitoring workers.
- SYSC 6.1.1R
- The FCA rule requiring firms to maintain policies and procedures sufficient to comply with the regulatory system, including countering the risk that the firm might be used to further financial crime.
- Financial crime
- Under section 1H of the Financial Services and Markets Act 2000, financial crime includes any offence involving fraud or dishonesty, so deliberate insider fraud at an FCA-regulated firm falls within it.
- Monitoring workers
- ICO guidance says that, apart from very exceptional circumstances, employers must tell workers about monitoring, and must carry out a DPIA before monitoring likely to cause high risk.
- Excessive agency
- OWASP's name for the weakness that lets an LLM-based system take damaging actions on unexpected or manipulated output; its root causes are excessive functionality, permissions or autonomy.
An insider threat is the risk that someone with legitimate access misuses it, deliberately or by mistake: an employee, contractor, supplier or AI agent acting on delegated access. Many insider incidents are careless rather than criminal, and the controls that address them (screening, access rights, monitoring and leaver processes) are ones a regulated firm should already run.
Your board has asked a direct question: how does the firm manage insider risk? Perhaps a peer has just disclosed a staff fraud, or your auditor wants evidence rather than reassurance. This list gives you the answer one insider threat at a time, for UK FCA-regulated firms and insurers of 50 to 250 people.
The seven types below were chosen by one test. Each reaches the firm through access the firm itself granted, and each maps to a control you already run, or should run, in an ISO 27001 information security management system (ISMS) and under the FCA's systems-and-controls rules. Outside attackers who never hold access are left out.
What types of insider threat should a regulated firm control?
A regulated firm should control seven types of insider threat: negligent staff, malicious staff, privileged users, compromised accounts, departing and moving staff, third parties with access, and AI agents acting on delegated access. Each one already has a home in an ISO 27001 control set, so the work is closing gaps, not buying a new programme.
For what ISO 27001 is and how Annex A is organised, start with our ISO 27001 hub. The table is the list itself. The sections below give each type the same three parts: what it is, when it matters and what to do.
| Insider threat | How it shows up | The control | ISO 27001 reference |
|---|---|---|---|
| 1. Negligent staff | A misdirected email, an open sharing link, a rule skipped to save time | Written rules, training and a no-blame route to report mistakes | A.5.10, A.6.3 |
| 2. Malicious staff | Fraud, client data taken to a competitor, sabotage after a grievance | Screening, segregation of duties and a disciplinary process | A.6.1, A.5.3, A.6.4 |
| 3. Privileged users | An administrator who can change access, logs or payment details | Named, time-limited admin rights, logged and reviewed by someone else | A.8.2, A.8.15 |
| 4. Compromised accounts | A real login used by someone else after a phish or a reused password | Strong authentication and alerts on unusual use | A.5.17, A.8.5, A.8.16 |
| 5. Departing and moving staff | Access still live after the last day, or kept after a change of role | Same-day leaver revocation and a rights review at every move | A.5.18, A.6.5 |
| 6. Third parties with access | A supplier account broader or longer-lived than the contract needs | Access terms in the contract, a named owner and an expiry date | A.5.19, A.5.20 |
| 7. AI agents with delegated access | An agent acting through an account with more permission than its task needs | Task-scoped permissions and human approval for high-impact actions | A.5.18, A.8.2 |
Why is an insider threat a regulatory issue for FCA-regulated firms?
For an FCA-regulated firm, an insider threat is a regulatory issue because staff fraud is financial crime, and the FCA's rules require firms to counter the risk of being used to further financial crime. Insider data misuse also engages UK GDPR, and so does the way a firm watches for it.
Three UK anchors matter. None of this is legal advice; take advice on your own position.
- FCA SYSC 6.1.1R. In Market Watch 80 (October 2024), the FCA says SYSC 6.1.1R requires firms to maintain policies and procedures sufficient to comply with the regulatory system, and that "this includes countering the risk that firms might be used to further financial crime". Under section 1H of the Financial Services and Markets Act 2000, financial crime includes any offence involving fraud or dishonesty.
- SM&CR. The Senior Managers and Certification Regime aims to make individuals "more accountable for their conduct and competence". The FCA notes the regime is being reformed, so check the current rules before relying on any detail.
- ICO monitoring guidance. The ICO's guidance on monitoring workers says that, apart from very exceptional circumstances, you must tell workers about any monitoring. It also requires a data protection impact assessment (DPIA) before monitoring likely to cause high risk. The ICO says the guidance is under review after changes made by the Data (Use and Access) Act, so check the current version.
Monitoring that staff were never told about is a liability, not a control.
Which insider threats come from your own staff?
Three insider threats come from people on your payroll: negligent staff who make mistakes, malicious staff who act on purpose, and privileged users whose actions travel furthest. The split between negligent and malicious matters, because the first calls for clearer rules and training, while the second calls for screening, separated duties and evidence.
1. Negligent staff
What it is. A person who exposes the firm through carelessness or a mistake, with no intent to harm. The US agency CISA's definition of insider threats separates negligent insiders, who know the policy and ignore it, from accidental ones, who simply make an error.
When it matters. Every working day. The ICO says failure to use BCC correctly in emails "is one of the top data breaches reported to us every year".
What to do. Write the rules down in an acceptable use policy, train staff against them, and give people a no-blame route to report a mistake within hours.
A firm that punishes self-reporting learns about its mistakes from its clients.
2. Malicious staff
What it is. An employee who misuses access on purpose: to commit fraud, to take client data to a competitor, or to damage systems after a grievance. CISA describes intentional threats as actions taken to harm an organisation for personal benefit or to act on a personal grievance.
When it matters. Wherever one person can both start and approve a payment, a claim or a bulk data export. In an FCA-regulated firm, deliberate insider fraud is also the financial crime that SYSC 6.1.1R expects your controls to counter.
What to do. Screen people before access is granted, in proportion to the role, as Annex A 6.1 sets out. Separate duties on every process that moves money or data, and keep a disciplinary process that can act on evidence.
3. Privileged users
What it is. Administrators, finance system owners and anyone else whose access lets them change other people's access, the logs or payment details. A privileged user's mistake or misdeed travels furthest, because the same access can hide it.
When it matters. As soon as a small IT team or an outsourced provider holds standing administrator rights across email, finance and client systems.
What to do. Grant privileged rights to named people, for a defined purpose and period, as Annex A 8.2 describes. Keep privileged activity logs where the administrator cannot edit them, and have someone else review them.
An administrator who can edit the audit log is not being audited.
Which insider threats come through accounts and exits?
Two insider threats arrive through access that outlives its purpose or its owner. Compromised accounts put an outsider behind a legitimate login. Departing and moving staff keep access past a last day or a change of role. Both are failures of the joiner, mover and leaver process, and both are fixed by process rather than products.
4. Compromised accounts
What it is. A legitimate account operated by someone else, usually after a phishing email or a reused password. To your systems, the activity looks like the employee's own work.
When it matters. Whenever a password alone can reach client data or payments, or when a login arrives from a place or device the user never works from.
What to do. Require strong authentication on email, remote access and finance systems. Alert on unusual use, as Annex A 8.16 expects, and treat a compromised account as an insider incident in your response plan, because the attacker now holds an insider's access.
5. Departing and moving staff
What it is. People whose access outlives their need for it: leavers whose accounts stay live after the last day, and movers who keep old permissions when they change role. The UK's National Protective Security Authority (NPSA) defines an insider as anyone who has, or previously had, authorised access to an organisation's resources.
When it matters. In the leaver window: the days between a resignation and the removal of every account, including shared logins and supplier portals that HR does not know about. A resignation to join a competitor raises the stakes.
What to do. Remove access on the last working day, from a list that covers every system, and review movers' rights at each change of role: Annex A 5.18 covers both. Remind leavers of the duties that continue after they go, as Annex A 6.5 describes.
An account nobody disabled is an insider you no longer employ.
Which insider threats sit outside your payroll?
Two insider threats hold your access without being your staff: third parties such as suppliers, contractors and outsourced IT, and AI agents acting on access that a person or team delegated to them. Neither appears on an HR leaver list, which is why each needs a named owner, a written scope and an expiry date.
6. Third parties with access
What it is. Contractors, outsourced IT providers and suppliers who hold accounts or connections into your systems. CISA counts them as insiders: people who have been "granted some level of access to facilities, systems, networks, or people to complete their work".
When it matters. When a supplier account is shared between several people, is broader than the contract needs, or is still live after the work ends.
What to do. Write access terms into the contract, and keep each supplier in the register you hold under Annex A 5.19. Give every third-party account a named owner on your side and an expiry date.
7. AI agents with delegated access
What it is. An AI tool that acts on your systems through a user's account or a service account: reading mailboxes, updating records or sending messages. The OWASP Top 10 for LLM applications calls the risk "excessive agency" and traces it to excessive functionality, permissions or autonomy.
When it matters. As soon as an agent can act, not just read, on client data or payments, or runs under a shared identity with high privileges.
What to do. Treat each agent as an account with a named owner. Scope its permissions to its task in the same access review as your staff, and, as OWASP recommends, require a human to approve high-impact actions before they are taken.
How to use this insider threat list
Work through the list in order of exposure. For most firms of 50 to 250 people, the first three moves are closing the leaver window, cutting standing privileged access and writing down how monitoring works. Each uses controls you already own, and each gives the board evidence rather than reassurance.
- Close the leaver window. Reconcile every active account, whether staff, supplier or agent, against your HR records and supplier register this month. Disable anything without a current owner.
- Cut standing privileged access. List every administrator account, remove rights nobody needs day to day, and start an independent review of privileged activity logs.
- Write down how you monitor. Set out what you monitor and why in your acceptable use policy, tell staff, and complete a DPIA where the monitoring is likely to be high risk.
We recommend reporting back to the board in the table's shape: each insider type, its control, its owner and the evidence that the control runs. That answers the original question on one page.
Frequently asked questions
The UK's NPSA defines insider risk as the likelihood of harm or loss because of an insider's action or inaction. An insider threat is narrower: an insider, or group of insiders, that intends to cause harm or is likely to. Managing insider risk means running the controls before any threat appears.
Yes, whenever they hold access to your systems, premises or data. CISA counts contractors and vendors granted access as third-party insiders. Treat their accounts like staff accounts, with a named owner on your side, a scope set by the contract and an expiry date.
Watch access and activity in your systems rather than people's private lives. Alerts on unusual logins, large exports and privileged changes point to the activity that matters. The ICO expects monitoring to be proportionate, and says you must tell workers about it apart from very exceptional circumstances.
No. CISA separates unintentional insiders, who are negligent or make accidental errors, from intentional ones who set out to cause harm. The controls differ: clear rules, training and easy reporting for the first group; screening, separated duties and evidence for the second.
