INSIDER THREAT DETECTION

A negligent insider puts the organization at risk without intending to, usually by falling for a phishing attack, reusing a weak password, or working on a personal or managed device infected with infostealer malware. A compromised insider is a legitimate employee whose credentials or session tokens have been stolen by an external attacker who then uses that access while the employee remains unaware. A malicious insider deliberately misuses access for gain or harm, including a fraudulent candidate who uses a stolen or fabricated identity to get hired in the first place. According to the SpyCloud 2025 Insider Threat Pulse Report, 97% of security professionals are concerned about negligent insider threats and 93% about malicious ones. Behavioral tools catch patterns only after access is misused, so all three can move undetected during the window between compromise and detectable behavior, which is the gap SpyCloud closes with recaptured criminal underground data.

A password reset invalidates the password, but it does not end an active session. Attackers steal active session cookies and authentication tokens that let them walk past login entirely, so a stolen session stays valid after the password changes and bypasses multifactor authentication. Full remediation has to reset the exposed password and revoke the active session together. SpyCloud Identity Guardians does both, resetting the password and triggering server-side session revocation through Active Directory, Microsoft Entra ID, or Okta Workforce so the exposed access is actually cut off.

Infostealer malware silently harvests everything tied to a device, including saved passwords, session cookies, authentication tokens, and business application logins, then sends that data to criminal markets. The infection often happens on a personal or unmanaged device outside the corporate perimeter, so it does not trigger a security alert. In 2025, SpyCloud recaptured 642.4 million exposed credentials from 13.2 million infostealer infections, and 40% of those infections occurred on endpoints that already had EDR or antivirus tools installed, according to the 2026 SpyCloud Identity Exposure Report. Once that data is exposed, a trusted employee becomes an unwitting entry point an attacker can use to log in as them.

Remote IT worker fraud is a scheme in which an operative uses a stolen or fabricated identity, often supported by fake resumes and multiple personas, to get hired into a remote role and gain trusted access. North Korean, or DPRK, IT worker campaigns are the most prominent example and have become a board-level concern. Traditional background checks miss it because each submitted identity element can look legitimate in isolation. SpyCloud investigates from the criminal underground side instead, correlating the identity artifacts a candidate submits against recaptured breach, malware, and phishing data to expose connected personas, shared VPN infrastructure, geographic inconsistencies, and reused password patterns before access is granted. According to the SpyCloud 2025 Insider Threat Pulse Report, 87% of organizations already involve HR or recruiting in their insider threat defense, but about 60% still coordinate manually with no automated workflows.

At pre-hire screening, SpyCloud Cybercrime Investigations correlates a candidate’s identity against recaptured criminal underground data to surface fraudulent identities or adversarial infrastructure before an offer is extended. During employment, SpyCloud Workforce Threat Protection and Endpoint Threat Protection continuously monitor for compromise, and Identity Guardians resets exposed passwords and revokes active sessions through Active Directory, Microsoft Entra ID, or Okta Workforce. At offboarding, SpyCloud can confirm whether a departing employee’s access artifacts are circulating in criminal markets so revocation is targeted. Routing these signals into IdP, SOC, and HR workflows through the SpyCloud API closes the manual coordination gap that most insider threat programs still have.