Insider Threat Detection for Small Businesses

What counts as an insider threat

An insider threat is the risk that someone with legitimate access uses it — deliberately or not — to harm the organisation. The US Cybersecurity and Infrastructure Security Agency defines an insider as any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. The word doing the work there is authorized. Nobody has to break in.

CISA's central distinction is between unintentional and intentional harm, and it separately flags two situations that cut across both. That gives you four labels you will meet in practice — worth knowing, because the phrase "the three types of insider threats" is repeated everywhere and does not match the source:

Now the part most articles on this subject skip. Insider incidents are not the most common way a small business gets breached, and you should be suspicious of anyone who tells you otherwise. Verizon's 2026 Data Breach Investigations Report — built on more than 31,000 real incidents — found internal actors in 12% of breaches, a decline from last year's 18%. Its small-business panel, covering organisations under 1,000 employees, attributes essentially all breaches to external actors with a financial motive.

So why spend an afternoon on this at all? Because the cost profile is inverted. The 2026 Ponemon Institute and DTEX Cost of Insider Risks study found insider incidents take an average of 67 days to contain, at roughly $747,000 per negligent incident, $742,000 per malicious one, and $842,000 where an outsider was using stolen credentials. Insider events are rarer than phishing, but they run longer before anyone notices, and what walks out is usually the material the business is actually built on.

Why departures are the pressure point

Because the risk concentrates in a narrow, predictable window. Carnegie Mellon's Software Engineering Institute — the CERT division that has studied insider cases for two decades — put it plainly in its analysis of intellectual-property theft cases: most insiders steal IP within 30 days of leaving an organization. That finding dates from 2011, and it is worth flagging its age; it has nonetheless held up as the organising principle of insider-risk practice ever since, and every vendor telemetry report published since clusters activity around the same departure window.

That single sentence is more operationally useful than any threat-intelligence feed a small business could buy. It means you do not need continuous surveillance of everyone. You need to know when someone is leaving, and to be looking at the right handful of signals for the weeks either side of that date.

Check the statistics before you plan around them

Three numbers dominate every article on employee data theft, and each one is quoted in a form that overstates it. This matters practically: if you believe half your staff steal data, you will buy the wrong thing and treat people badly doing it.

• "45% of employees take data when they leave." Real, but it is the US subset of a May 2020 Tessian survey. The overall figure in the same study was 34%, and the UK figure was 23%. The qualifier gets dropped almost every time it is quoted.
• "72% of employees take company data." This is a misreading. The 72% in Code42's 2019 report is the share of information security leaders who agreed with the attitude statement it's not just corporate data, it's my work — and my ideas. It is a finding about how people feel about ownership, not about how many of them copy files.
• "63% brought data from a previous employer." This one has a real, findable source — Code42's 2019 Global Data Exposure Report, published October 2019. But mind the population, which is the same slip the 72% turns on: the respondents were 1,028 security leaders and 615 business decision-makers, not a cross-section of staff. And it describes people arriving with data, which is a different risk from the one you are trying to detect on the way out.

The most defensible figure is from Cyberhaven Labs in 2022, and it is defensible precisely because it is observed telemetry rather than self-report: across roughly 1.4 million employees handling sensitive data, 9.4% exfiltrated data over a six-month window. The blog post carrying that figure has since been taken down — the underlying report survives as a gated download — so it is most easily checked today through contemporaneous press coverage. Treat it as dated either way. DTEX's 2023 investigations report puts the share of departing employees taking sensitive intellectual property at 12%.

CISA's guidance is also worth internalising here: threat assessment should be based on behaviours, not profiles, and these acts are rarely spontaneous — they follow a deliberate decision. There is no demographic pattern to watch for, and looking for one will make you both wrong and unfair.

How data actually leaves

Data leaves a small Windows network through a short, boring list of channels. What matters operationally is not the channel itself but whether it leaves an artifact you can find afterwards — and for several of them, the honest answer is that it does not.

In MITRE ATT&CK terms these map to T1052.001 (Exfiltration over USB), T1567.002 (Exfiltration to Cloud Storage — MITRE's own description names Dropbox and Google Docs) and T1114.003 (Email Forwarding Rule). MITRE's detection analytic for the USB case is USB device insertion followed by high-volume or sensitive file access and staging — which is exactly Event 6416 correlated with 4663, and exactly what the next sections set up.

Before you monitor anything

Before you enable a single audit policy, write the notice. This is not a compliance footnote to tidy up later — in three US states it is a statutory duty that attaches before monitoring begins, and none of those statutes exempts small employers. A ten-person company in New York is covered exactly as a ten-thousand-person one.

The federal baseline, and the trap

The Electronic Communications Privacy Act is the federal floor. Two exceptions do most of the work for employers. The provider exception at 18 U.S.C. § 2511(2)(a)(i) covers interception on your own facilities where it is a necessary incident to the service or to the protection of the rights or property of the provider of that service. Separately, § 2511(2)(d) makes federal law one-party consent: lawful where one of the parties to the communication has given prior consent.

The practical leverage — and it is real, even though it is not the clean single-document story you will sometimes hear — is that a signed monitoring acknowledgement does double duty. Federal law does not require consent where the provider exception already applies, but consent is the second, independent route under § 2511(2)(d), and having both is a sturdier position than relying on either alone. The same signature simultaneously satisfies the acknowledgement New York and Delaware ask for.

It does not cover everything, though, and three gaps are worth naming. A signature alone does not discharge the posting duty — New York requires the notice on the wall as well as acknowledged, and in Connecticut the posting is the required notice. The scope of the provider exception is judicially developed rather than a bright line, so "we own the laptop" is a strong starting position, not a settled defence. And if you record calls, check your state's wiretap law separately: several states require all parties to consent, which is stricter than the federal floor.

If you have staff in the EU, the answer inverts

Under the GDPR, the working lawful basis for workplace monitoring is legitimate interests under Article 6(1)(f) — not consent. The Article 29 Working Party's Opinion 2/2017 held that employees are almost never in a position to freely give, refuse or revoke consent and that consent is highly unlikely to be a legal basis for data processing at work. This is the precise opposite of the US position, where a signature is your strongest defence.

Legitimate interests requires a documented three-part test — a specific purpose, genuine necessity with no less intrusive alternative, and a balancing exercise against employees' rights — and Article 21 gives every employee the right to object. A data protection impact assessment is required where monitoring is systematic and likely to be high risk, which national regulators consistently treat continuous employee monitoring as being. Article 88 also lets member states impose stricter national rules, so Germany, France and the Netherlands in particular go further than the GDPR baseline.

The zero-cost detection setup

To detect the most common exfiltration channels, you can start with Group Policy settings that ship with Windows and cost nothing. Here is the order that gives the most coverage for the least work.

1. Audit Removable Storage — the single highest-value setting

This is the one to enable first, and the reason is a detail Microsoft states in its own documentation and almost nobody repeats: A security audit event is generated for all objects and all types of access requested, with no dependency on object's SACL.

Read that again if you have ever tried to set up file auditing. Ordinary file-system auditing is inert until you configure system access control lists on every folder you care about — Microsoft is explicit that no audit events are generated for the default file system SACLs. Audit Removable Storage skips all of it. Turn it on, and you get a 4663 event for every file read from or written to a USB device, on every machine, with no per-folder engineering. Microsoft's guidance rates it Success and Failure on workstations, member servers and domain controllers alike, where Audit File System is rated only "if needed".

2. Audit PNP Activity — know when a device appeared

This one lives under Detailed Tracking, not Object Access — a small thing that costs people ten minutes of hunting through the policy tree. It produces Event ID 6416, "A new external device was recognized by the System", on Windows 10 and Server 2016 or later. The payload carries the device instance path, vendor IDs and a ClassName — filter for DiskDrive to separate storage from keyboards and mice. Microsoft rates the volume as typically low and adds a useful tuning tip: report it whenever the Subject Security ID is not SYSTEM. Note the limit — 6416 records insertion and enablement, not removal, so it will not tell you how long a stick was plugged in.

3. Audit Logon — catch the off-hours pattern

Event ID 4624 records successful logons with a Logon Type: 2 for interactive at the keyboard, 3 for network, 10 for RDP, 7 for unlock. Microsoft explicitly endorses the use case: you might need to monitor for use of an account outside of working hours. A Saturday-night type 10 logon from an account that has never worked a weekend is the cheapest high-signal alert you will ever build.

4. SACLs, but only where they earn it

For the two or three shares that genuinely hold the crown jewels, add a SACL and enable Audit File System. One caveat worth knowing: Microsoft's recommended list of access types to monitor covers writes, deletes and permission changes — but not ReadData. Reading is what theft looks like, so add it deliberately. Microsoft also warns against blanket enablement, and it is right: SACL a whole file server and you will drown, then stop looking, which is worse than not logging at all.

5. Raise the log size, then actually book the review

The default Security log rolls over quickly once 4663 events start flowing, and a log that has already overwritten the evidence is not a control. Increase the size first. Then put a recurring monthly appointment in the calendar — USB events, off-hours logons, any new mailbox forwarding rules. Detection is a habit, not a checkbox; logging nobody reads has never caught anyone.

One free addition worth the install: Sysmon, from Microsoft's Sysinternals suite, fills several of the gaps above. Event 3 logs network connections tied to a process — it is off unless you configure it — and Event 22 logs DNS queries, so a lookup for a consumer file-sharing domain becomes visible. Event 9 catches raw disk reads, which Microsoft notes are used to avoid file access auditing tools. Those three are the ones worth running routinely.

Sysmon can also log clipboard changes (Event 24), and you should think hard before switching that on. Clipboards carry passwords, personal messages and other people's data, and capturing them is a categorically more intrusive thing than logging that a file moved. If you do enable it, say so explicitly in the monitoring notice rather than folding it under a general description — the disclosure has to match what you actually collect, or the notice is not doing its job.

What Windows cannot see

Windows cannot see inside encrypted traffic, and that single limitation defines the boundary of the free setup. Being straight about this matters more than another list of features, because a control you wrongly believe you have is worse than one you know you lack.

• HTTPS payloads. Every webmail upload, consumer cloud sync and messaging app is opaque. You may see that a connection happened; you will not see what went through it.
• Network egress with attribution. Windows Firewall logging is off by default, and even switched on it records connection tuples — not which process or which user.
• Which file went where. Windows logs file reads and network sends independently and never correlates them. Joining those two halves is precisely what data loss prevention products are for.
• A phone camera pointed at the screen. No artifact, no control, no product. It is the oldest exfiltration channel and still unsolved.

Two things the internet gets wrong

First, session duration. A lot of guidance suggests pairing logon event 4624 with logoff event 4634 to measure how long someone was working. Microsoft documents that use case but attaches a warning most write-ups drop: Logoff events are not 100 percent reliable. For example, the computer can be turned off without a proper logoff and shutdown; in this case, a logoff event is not generated. Session length is a reasonable trend to look at; build a hard alert on it and it will fire on people who simply closed their laptop.

Second, print logging. Enabling the PrintService operational log is commonly presented as giving you a record of what was printed. It gives you Event 307 with the job — but the document name is obfuscated to the literal string "Print Document" until you change a separate setting. Turn on the log, print a test page, and check the name before you rely on it.

There are also two widely-circulated USB forensics claims — a set of DriverFrameworks event IDs for plug and unplug, and a Partition diagnostic event carrying device serial numbers — that appear in dozens of blog posts but are documented by Microsoft nowhere, and the relevant log is disabled by default. They may well work. Do not build a control on them without testing on your own hardware first.

When tooling earns its keep

Tooling earns its keep at the point where the free setup stops answering the questions you are actually asking — usually when you need visibility into encrypted uploads, or when reviewing raw event logs by hand stops being realistic. Here is an honest comparison at the 10-to-50-PC scale.

The gap that pushes most small businesses off the free tier is not detection capability but legibility. Windows will happily record thousands of 4663 events; turning them into "here is what this person did in their last fortnight" is manual work nobody sustains. That is the job disclosed activity monitoring on company machines does — and it only works, legally and culturally, on the disclosure footing set out earlier.

Whatever you choose, apply it to everyone at the same level rather than singling out the person you suspect. Targeted, secret monitoring of one employee is where the legal exposure lives, and it is also how you destroy the trust of the nine colleagues who find out about it later.

The departure checklist and the first hour

Given that most intellectual-property theft happens within 30 days of departure, the checklist below is worth more than any tool on the previous list. Everyone says "revoke access immediately"; almost nobody writes down what that means in practice.

• Disable the account, do not delete it. Deleting destroys the audit trail and any mailbox you may need later.
• Revoke active sessions and tokens, not just the password. A signed-in session on a personal phone survives a password change.
• Check mailbox forwarding rules — both mailbox-level forwarding and inbox rules. Rules can be created so that they do not display in Outlook, so check server-side.
• Pull the audit log now, not later. Microsoft 365 Audit (Standard) retains records for 180 days by default — but the deprecated admin audit search reaches back only 90, and retention differs by licence. Export what you need rather than trusting it will still be there next quarter.
• Disconnect personal cloud sync clients from the machine and check which folders were being synced.
• Rotate shared credentials — the Wi-Fi key, the shared admin login, the accounts nobody has got round to giving individual logins to. In a small business this is usually the longest part of the list.
• Retrieve the hardware, including any personally-held drives or dongles, and record what came back.
• Hold the leaver's device untouched for a fortnight before rebuilding it, if the departure was at all sour.
• Run the exit interview with the IP agreement in hand. Carnegie Mellon's CERT division has long recommended using the exit interview to walk the leaver through the agreement they signed, and to have them re-acknowledge it. It costs ten minutes and it is the only item on this list that addresses intent rather than opportunity.

If you think it is happening right now

Preserve first, investigate second, act third — in that order, because the natural instinct gets all three backwards.

1. Do not shut the machine down. Powering off loses everything held in memory and can trigger cleanup on shutdown. Isolate it from the network instead and leave it running.
2. Do not browse around on it. Every folder you open rewrites access timestamps — the same metadata you would later rely on. If the matter might end up in front of anyone, get an image taken first.
3. Capture the logs before they roll. Export the Security log from the endpoint and the relevant Microsoft 365 audit search straight away.
4. Never open their personal accounts. Saved credentials in a company browser do not give you authorisation, and using them is where an employer's strong position collapses.
5. Call counsel before you confront anyone. A conversation held on incomplete evidence tips off the one person who can still delete things — and if you are wrong, you have accused an employee of a crime.

None of this requires a security team. It requires deciding, before anything happens, that you will do the boring version properly: the notice signed on day one, three audit policies switched on, a checklist that runs every time someone leaves, and an hour a month spent actually looking. That is what insider threat detection looks like at this size, and it is entirely within reach.

Frequently asked questions