Insider threats explained for small organisations

Insider threats are risks that come from people inside an organisation: staff, contractors, volunteers or anyone else who has, or used to have, legitimate access. This guide explains insider threats in general terms for small organisations: the difference between accidental and deliberate insider risk, what Australian government guidance says, and how access control and offboarding (removing access when someone leaves) are described by ASD’s ACSC and Microsoft.

Many insider incidents aren’t dramatic. They can be as ordinary as an email sent to the wrong person, a shared password nobody changed, or an account left open after someone moved on.

What counts as an insider threat

business.gov.au lists “current or former employees who accidentally or intentionally compromise your information” as one possible source of cyber threats to a business. That definition covers two quite different situations.

Accidental insider risk is when someone with access causes harm without meaning to. The Office of the Australian Information Commissioner (OAIC) uses the term human error in its data breach reporting, and defines it as “an unintended action by an individual directly resulting in a data breach”. Examples the OAIC lists include:

• personal information sent to the wrong recipient by email, mail or other channels
• failure to use BCC, so a group email shows every recipient’s address
• insecure disposal
• loss of paperwork or a data storage device
• unauthorised disclosure, including failing to redact information or disclosing it verbally.

Deliberate insider risk is when someone acts against the organisation on purpose. The OAIC’s reporting treats this as a type of malicious or criminal attack and defines a rogue employee or insider threat as “an attack by an employee or insider acting against the interests of their employer or other entity”.

A third situation sits between the two: an insider whose account is taken over by an outsider, for example after a phishing email. The person didn’t intend harm, but their access is being misused. That’s one reason access control matters even in a team where everyone is trusted.

Why it matters for small organisations

Small teams often run on trust and convenience. People share logins, everyone has access to everything, and when someone leaves, nobody is quite sure which accounts they had. None of that implies anyone is acting badly, but it does mean that one mistake, or one compromised account, can reach a lot of information.

ASD’s ACSC small business guide puts it this way: “Restricting user access can limit the damage caused by a cyber security incident.” It says “Typically, staff do not require full access to all data, accounts, and systems in a business”, and that with proper access controls, ransomware might affect only a small number of files rather than the entire business.

A fictional example

Sam runs a five-person design studio. Everyone uses one shared login for the studio’s cloud file storage and one for the business email newsletter. A designer, Lee, leaves on good terms. Months later Sam notices the newsletter tool has been sending messages he didn’t write.

There’s no suggestion Lee did anything. The more likely story is that the shared password, still unchanged, had been saved on Lee’s old laptop, which was later sold. This is exactly the situation the ACSC guide describes: “Unless you change the password, employees could also continue accessing accounts even after they have left the business.”

How to limit access: what ASD’s ACSC describes

Access control is “a way to limit access to certain files and systems”, in the ACSC small business guide’s words. The guide’s key points:

• “Ensure each user can access only what they need for their role.” This idea is often called least privilege.
• Staff typically don’t need full access to all data, accounts and systems.
• “Sharing accounts can compromise security and makes it difficult to track malicious activity.” The guide says to “limit the use of shared accounts and secure any that are used in your business.”
• The guide says “Administrative accounts should be secured with a strong passphrase or multi-factor authentication.”

Administrator access

Administrator accounts can change settings, add users and see everything, so they matter most. The Essential Eight’s “restrict administrative privileges” strategy at Maturity Level One includes:

• “Requests for privileged access to systems, applications and data repositories are validated when first requested.”
• “Privileged users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.”
• Privileged user accounts (other than those explicitly authorised to access online services) “are prevented from accessing the internet, email and web services”.

For a plain-English overview of the framework, see the Essential Eight explained. For how this works in Microsoft 365, see admin roles and least privilege in Microsoft 365.

How to remove access when someone leaves

Offboarding is the process of closing off a person’s access when they leave or change roles. It protects the organisation whether the departure is friendly or not, and it protects the departing person too, because activity on an account they no longer use can’t be wrongly attributed to them.

In general terms, offboarding usually covers:

• the person’s own accounts (email, cloud storage, business apps)
• any shared accounts or passwords they knew, which the ACSC guide says to change
• company data on their devices, including phones
• forwarding or handing over email and files so work isn’t lost
• licences and building access such as keys or swipe cards.

How Microsoft describes it for Microsoft 365

Microsoft’s “Remove a former employee and secure data” overview (checked October 2026) sets out seven steps. Microsoft Learn has the current detail for each.

1. Prevent the former employee from signing in to Microsoft 365 services.
2. Save the contents of their mailbox, if someone is taking over the work or the data needs to be kept.
3. Wipe and block their mobile device, which Microsoft says “removes your organization’s data from the former employee’s phone or tablet”.
4. Forward their email to another employee, or convert the mailbox to a shared mailbox.
5. Give another employee access to their OneDrive and Outlook data.
6. Remove and delete their Microsoft 365 licence.
7. Delete their user account. Microsoft says that after an account is deleted, the content in the person’s OneDrive and Outlook is retained for 30 days, during which the account can be restored.

Our guide to offboarding staff in Microsoft 365 explains these steps in more depth.

How to reduce accidental insider risk

Because many insider incidents are mistakes, awareness matters. ASD’s ACSC small business guide says “The best defence against email attacks is training and awareness for your employees”, and that “cyber security training isn’t a once-off requirement and should be refreshed periodically.” See staff security awareness for small teams.

Practical measures that follow from the OAIC’s list of human-error breaches include checking recipients before sending personal information, using BCC for group emails, and disposing of documents and devices securely.

Things to watch for

• Shared logins that never change. The ACSC guide notes they make it hard to trace activity and can outlast someone’s employment.
• Access that only grows. People change roles and keep old permissions. Periodically reviewing who can access what follows the ACSC’s “only what they need for their role” principle.
• Forgotten accounts. Accounts in less obvious tools (social media, newsletter platforms, suppliers’ portals) are easy to miss at offboarding.
• Personal devices. Company data on personal phones and laptops is part of offboarding too.
• Legal and employment questions. Monitoring staff or responding to suspected misconduct can involve workplace and privacy law. This guide doesn’t cover those areas.

If something goes wrong: where to report

If personal information may have been exposed, the OAIC’s Notifiable Data Breaches scheme may apply; our guide to data breaches explains how it works. ASD’s ACSC runs ReportCyber, and business.gov.au and the ACSC small business guide both list the ACSC’s 24/7 hotline as 1300 CYBER1 (1300 292 371). A written incident response plan helps a small team know who does what.

Common questions

What is an insider threat?

It’s a risk that comes from someone with legitimate access, such as an employee, contractor, volunteer or former staff member. business.gov.au lists “current or former employees who accidentally or intentionally compromise your information” as one possible source of cyber threats. The harm can be accidental, deliberate, or the result of an outsider taking over an insider’s account. See what counts as an insider threat.

What are some examples of accidental insider threats?

The OAIC’s examples of human-error breaches include sending personal information to the wrong recipient, not using BCC on a group email, insecure disposal, losing paperwork or a storage device, and failing to redact information. The OAIC defines human error as “an unintended action by an individual directly resulting in a data breach”. See how to reduce accidental insider risk.

How do I remove a former employee’s access?

In general terms, offboarding covers closing the person’s own accounts, changing any shared passwords they knew, removing company data from their devices, and handing over email and files. The ACSC guide notes that unless a shared password is changed, people could keep accessing accounts after they’ve left. Microsoft’s overview for Microsoft 365 sets out seven steps. See how to remove access when someone leaves.

Is it OK to share one login across a small team?

ASD’s ACSC small business guide says “Sharing accounts can compromise security and makes it difficult to track malicious activity.” It says to “limit the use of shared accounts and secure any that are used in your business”, and that each user’s access should be limited to what they need for their role. See how to limit access.

Is insider risk relevant to a small business?

The ACSC small business guide says “Restricting user access can limit the damage caused by a cyber security incident”, and that staff typically don’t need full access to all data, accounts and systems. In small teams, shared logins and broad access can mean one mistake or compromised account reaches a lot of information. See why it matters for small organisations.

What do I do if an insider incident exposes personal information?

If personal information may have been exposed, the OAIC’s Notifiable Data Breaches scheme may apply. ASD’s ACSC runs ReportCyber, and business.gov.au and the ACSC small business guide list the 24/7 hotline as 1300 CYBER1 (1300 292 371). Workplace and privacy law questions are outside this guide’s scope. See if something goes wrong.

Where to get official help

• business.gov.au for small business cyber security guidance and tools
• ASD’s ACSC for ReportCyber and the 24/7 hotline: 1300 CYBER1 (1300 292 371)
• Microsoft Learn for current Microsoft 365 offboarding steps
• The OAIC for information about the Notifiable Data Breaches scheme