Insider Threat Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity | Last updated: September 4, 2026 | License: CC BY 4.0
Insider risk cost the average organization $19.5 million in 2025, up 12.1% year over year, while the share of confirmed breaches involving internal actors fell from 18% to 12%. Cost is rising as visible frequency falls. That divergence, not the raw dollar figure, is the story of the 2026 insider cycle.
Quick Answer
Insider security incidents cost the average organization $19.5 million annually across 354 benchmarked companies, per the Ponemon Institute 2026 Cost of Insider Risks study, while Verizon’s 2026 DBIR recorded internal actors in 12% of confirmed breaches, down from 18%. According to Axis Intelligence Research, the Axis Insider Containment Premium (AICP) stands at 54.2%: organizations that take more than 90 days to contain an insider incident pay $21.9 million against $14.2 million for those closing inside 30 days, an implied $128,333 for every day of delay.
Key Findings
- According to Axis Intelligence Research, the Axis Insider Containment Premium (AICP) is 54.2% for 2025 — a $7.7 million gap between insider programs that contain in under 30 days ($14.2M) and those that take more than 90 days ($21.9M), which works out to roughly $128,333 per day across the 60-day boundary span.
- According to Axis Intelligence Research, the Axis Insider Cost per Seat (AICS) shows organizations under 500 employees carry at least $17,800 of annual insider risk cost per head against no more than $379 per head at organizations above 75,000 — a gradient of at least 47 to 1.
- According to Axis Intelligence Research, the average benchmarked organization absorbs 25.4 insider incidents a year at a blended $767,717 each — one material insider event every 14.4 days.
- According to Axis Intelligence Research, the Axis Insider Remediation Ratio (AIRR) across three prosecuted North Korean IT worker schemes is 0.73 — victim companies spent about 73 cents auditing and rebuilding systems for every dollar they paid the fraudulent employee, or roughly $26,786 per victim company.
- Internal actors appeared in 12% of the 22,345 breaches analyzed in the Verizon 2026 Data Breach Investigations Report, and 75% of those internal actors were ordinary end users rather than system administrators.
How Much Do Insider Threats Cost in 2026?
The reference figure is $19.5 million per organization per year. It comes from the Ponemon Institute’s 2026 Cost of Insider Risks: Global study, the seventh edition of the benchmark, built from interviews with 8,750 IT and IT security practitioners at 354 organizations that experienced at least one material insider event. The study analyzed 7,490 insider incidents across those organizations during 2025.
That $19.5 million splits three ways, and the split is where most coverage stops being useful.
Insider risk cost by root cause
| Root cause | Share of incidents | Incidents per org | Cost per incident | Annual cost per org | Source |
|---|---|---|---|---|---|
| Negligent or careless employee | 53% | 13.8 | $747,107 | $10.3M | Ponemon Institute 2026 |
| Malicious or criminal insider | 27% | 6.3 | $742,125 | $4.7M | Ponemon Institute 2026 |
| Credential theft (imposter risk) | 20% | 5.3 | $842,462 | $4.5M | Ponemon Institute 2026 |
| All insider incidents | 100% | 25.4 | $767,717 (Axis) | $19.5M | Axis Intelligence Research calculation |
Two derived figures matter here. Multiplying the published incident counts by the published per-incident costs returns $19,450,513 against a published annual total of $19.5 million — a 0.25% variance, which is rounding, and which tells a reader the two halves of the study reconcile. According to Axis Intelligence Research, dividing the annual total by the 25.4 incidents gives a blended cost of $767,717 per insider incident, and a cadence of one material insider event every 14.4 days at the average benchmarked organization.
Credential theft is the costliest single category at $842,462 per incident, up 8.0% from $779,707, with incident frequency up 10.4% from 4.8 to 5.3 per organization. Ponemon classifies credential theft as an insider category because the attacker operates as a legitimate user; the external half of that story sits in our credential attack statistics analysis, and the two pages deliberately measure different sides of the same event.
Marcus Chen, Cybersecurity: Read the mix, not the headline. Negligence is 53% of incidents and 52.8% of cost, malicious insiders 27% and 24.1%, credential theft 20% and 23.1%. Cost tracks frequency almost exactly, which means there is no severity premium hiding in any one insider category at the portfolio level. That kills the standard vendor pitch, which is that the malicious insider is the expensive one you must buy a product to catch. The expensive one is whichever one you have the most of, and for almost every organization in this dataset that is somebody who misconfigured a share or mailed the wrong file. Spend accordingly.
What Does Slow Containment Actually Cost? The Axis Insider Containment Premium
Mean time to contain an insider incident fell to 67 days in 2025 from 81 days in 2024, the second consecutive annual improvement and the sharpest since the benchmark began. Only 13% of incidents were contained inside 30 days.
The published data also states what containment speed is worth, and nobody appears to have converted it into a usable rate. So Axis Intelligence Research did.
The Axis Insider Containment Premium (AICP)
What it measures: the financial penalty an organization pays for slow insider incident containment, expressed both as a percentage and as an implied cost per day of delay.
Inputs (both published, both from the same study population): average annualized insider cost where containment exceeds 90 days ($21.9M) and where containment completes inside 30 days ($14.2M).
Formula: AICP = (cost above 90 days − cost under 30 days) ÷ cost under 30 days × 100. Implied daily rate = (cost above 90 days − cost under 30 days) ÷ the 60-day span between the two published thresholds.
Worked calculation: $21,900,000 − $14,200,000 = $7,700,000. Divided by $14,200,000, times 100 = 54.2%. Divided by 60 days = $128,333 per day.
| Containment speed | Average annual insider cost | Index (under 30 days = 100) | Source |
|---|---|---|---|
| Contained in under 30 days | $14,200,000 | 100.0 | Ponemon Institute 2026 |
| Contained in more than 90 days | $21,900,000 | 154.2 | Ponemon Institute 2026 |
| AICP (premium) | +$7,700,000 | +54.2% | Axis Intelligence Research |
| Implied cost per day of delay | $128,333 | — | Axis Intelligence Research (estimate) |
The daily rate is an estimate, and its basis is stated so anyone can argue with it: it spreads the gap evenly across the interval between the two reported thresholds. Real containment cost is unlikely to accrue linearly. What the figure gives a security leader is a defensible order of magnitude for a business case, which is more than the raw 67-day average gives them.
Set that against how insider budgets are actually allocated. The average organization spends $247,587 containing a single insider incident and $39,728 escalating it, a 6.2 to 1 ratio between the most and least expensive activity centers. According to Axis Intelligence Research, the money is concentrated at the stage that AICP shows is most sensitive to delay, which is the correct place for it to be — provided the spend is buying speed rather than headcount after the fact.
Two controls carry published savings. Privileged access management is associated with an average $6.1 million reduction, equal to 31.3% of the $19.5 million baseline. User behavior analytics is associated with $5.1 million, or 26.2%.
Marcus Chen, Cybersecurity: Sixty-seven days is progress and it is still two months of an authorized account doing whatever it was going to do. The number defenders should quote upward is not the average, it is the 13%. Thirteen percent of insider incidents close inside a month, which means the other 87% of your insider caseload lives in the zone where AICP is charging you six figures a day. Compare that with external intrusion work, where dwell time has been the industry’s tracked metric for fifteen years and boards understand it. Insider containment has no equivalent public benchmark culture, and that is precisely why it is slower.
Which Organizations Carry the Most Insider Risk per Employee?
Aggregate cost figures reward large organizations for being large. Normalize by headcount and the risk profile inverts.
The Axis Insider Cost per Seat (AICS)
What it measures: annual insider risk cost per employee, by organizational size band, as a bounded range rather than a false point estimate.
Inputs: Ponemon 2026 reports $8.9 million in average annual insider cost for organizations with headcount below 500, and $28.4 million for organizations above 75,000. The study reports open-ended bands, so the arithmetic yields bounds, not midpoints.
Formula: AICS = annual insider cost ÷ the stated headcount boundary. For the sub-500 band the boundary is a maximum headcount, so the result is a floor. For the 75,000-plus band the boundary is a minimum headcount, so the result is a ceiling.
Worked calculation: $8,900,000 ÷ 500 = at least $17,800 per employee. $28,400,000 ÷ 75,000 = no more than $379 per employee. Gradient = at least 47.0 to 1.
| Organization size | Annual insider cost | AICS (Axis) | Basis | Source |
|---|---|---|---|---|
| Under 500 employees | $8,900,000 | At least $17,800 per employee | Floor (headcount ceiling used) | Axis Intelligence Research from Ponemon 2026 |
| Over 75,000 employees | $28,400,000 | No more than $379 per employee | Ceiling (headcount floor used) | Axis Intelligence Research from Ponemon 2026 |
| Gradient | — | At least 47.0x | — | Axis Intelligence Research |
According to Axis Intelligence Research, a 400-person company carries a minimum of 47 times the insider risk cost per head that a 75,000-person company does. The direction is the finding. Insider risk does not scale with headcount because the fixed costs of an incident — forensic investigation, legal review, notification, remediation of the systems the person touched — barely move with company size, while the denominator moves enormously.
Insider cost by region and sector
| Segment | Annual insider cost | Variance vs $19.5M global | Source |
|---|---|---|---|
| North America | $24,000,000 | +23.1% | Ponemon Institute 2026 |
| Europe | $18,600,000 | −4.6% | Ponemon Institute 2026 |
| Health and pharmaceuticals | $28,800,000 | +47.7% | Ponemon Institute 2026 |
| Technology and software | $24,200,000 | +24.1% | Ponemon Institute 2026 |
| Global average | $19,500,000 | Baseline | Ponemon Institute 2026 |
Health and pharma carries the highest activity cost of any sector at $28.8 million, 47.7% above the global average. Technology and software follows at $24.2 million. Regionally, North American organizations absorb $24 million, 23.1% above global, and European organizations $18.6 million.
Who Are the Insiders in Confirmed Breaches?
The cost benchmark measures organizations that know they had an insider incident. The Verizon 2026 Data Breach Investigations Report measures what turns up in a global incident corpus, and it produces a very different-looking picture: more than 31,000 incidents and more than 22,000 confirmed breaches across 145 countries, covering November 1, 2024 through October 31, 2025.
| Measure | Value | Sample | Source |
|---|---|---|---|
| Breaches involving internal actors | 12% | n=22,345 | Verizon 2026 DBIR |
| Same measure, prior edition | 18% | 2025 DBIR | Verizon 2026 DBIR |
| External actors | 88% | n=22,345 | Verizon 2026 DBIR |
| Internal actor variety: end users | 75% | n=1,000 | Verizon 2026 DBIR |
| Internal actor variety: system administrators | 19% | n=1,000 | Verizon 2026 DBIR |
| Human element present in breach | 62% | n=22,624 | Verizon 2026 DBIR |
| Credentials as compromised data type | 28% | n=19,538 | Verizon 2026 DBIR |
Internal actors fell from 18% of breaches to 12%, a 33.3% relative decline. The Privilege Misuse pattern, which is the DBIR’s category for insiders abusing entrusted access, has fallen further still. Across the four-year pattern mix published on the report cover, Privilege Misuse runs at 8% for the 2024 edition, 7% for 2025 and 3% for 2026 — a 62.5% decline over two editions.
Verizon is explicit that most internal cases are not sabotage. They are mistakes, misconfigurations and unapproved workarounds carried out with no malicious intent and very real consequences. The Lost and Stolen Assets pattern makes the point numerically: 525 incidents, of which only 88 were confirmed breaches, with internal actors responsible in 88% of them and personal data exposed in 96%. Verizon notes that assets going missing through insider error is roughly four times more likely than theft by a financially motivated outsider.
Marcus Chen, Cybersecurity: Two datasets, opposite directions, and both are right. Ponemon asks organizations what their insider incidents cost and gets $19.5 million. Verizon counts what appears in a forensic corpus and finds internal actors in 12% of breaches, falling. These are not contradictory readings of the same thing. A misconfigured storage bucket that leaks internal documents is a Ponemon incident with a real invoice attached and frequently never becomes a DBIR breach, because nobody can confirm disclosure. Privilege Misuse dropping to 3% of the pattern mix is not evidence that insiders stopped abusing access. It is evidence that the corpus is being flooded with ransomware and third-party cases, and that insider abuse remains the hardest category in security to prove after the fact.
Why Axis Intelligence Research will not merge these two datasets
An obvious and popular move is to multiply the DBIR’s 12% internal-actor rate by a breach cost average and publish a global insider-attributable breach cost. Axis Intelligence Research does not publish that figure, and the refusal is recorded in the accompanying dataset as a retracted row.
The inputs are incompatible. The DBIR rate comes from a contributed incident corpus of more than 22,000 confirmed breaches supplied by law enforcement and response firms, covering November 2024 to October 2025. The IBM 2026 Cost of a Data Breach Report mean of $4.99 million comes from 602 organizations that agreed to structured interviews, covering March 2025 to February 2026. Ponemon’s insider study covers 354 organizations selected because they already had an insider incident. Three populations, three sampling frames, three windows. Their product would carry a dollar sign and no meaning, and figures of exactly that construction get recited for years before anyone checks them.
How Much Does a Fraudulent Insider Hire Cost the Company That Hired Them?
The fastest-moving insider category of the past two years is not the disgruntled employee. It is the employee who was never real.
United States prosecutors have now built a substantial public record on North Korean remote IT worker schemes, in which operatives use stolen and fabricated identities to obtain salaried engineering jobs at Western companies, with domestic facilitators hosting company laptops so the work appears to originate from a United States address. Court documents state the mechanics precisely: laptops shipped to a facilitator’s residence, unauthorized remote desktop software installed, and hardware keyboard-video-mouse switches used to hand control to an operator overseas.
Because charging documents state both what victim companies paid the workers and what they spent cleaning up afterward, the enforcement record supports a cost metric that no vendor survey can produce.
The Axis Insider Remediation Ratio (AIRR)
What it measures: dollars of victim-company audit and remediation cost per dollar of salary paid to a fraudulent insider, computed from court-documented figures only.
Formula: AIRR = total stated victim remediation cost ÷ total stated salary or scheme revenue, summed across prosecuted cases with both figures on the record.
Worked calculation: ($500,000 + $1,000,000 + $3,000,000) ÷ ($250,000 + $943,069 + $5,000,000) = $4,500,000 ÷ $6,193,069 = 0.73.
| Case | Victim companies | Paid to workers | Victim remediation cost | Remediation per company | Source |
|---|---|---|---|---|---|
| U.S. v. Knoot (M.D. Tenn.) | At least 4 | Over $250,000 | Over $500,000 | $125,000 | DOJ, May 6, 2026 |
| U.S. v. Prince and co-defendants (S.D. Fla.) | Over 64 | $943,069 | Over $1,000,000 | $15,625 | DOJ, May 6, 2026 |
| U.S. v. Zhenxing Wang and co-defendants (D. Mass.) | Over 100 | Over $5,000,000 | At least $3,000,000 | $30,000 | DOJ, June 30, 2025 |
| Combined | At least 168 | $6,193,069 | $4,500,000 | $26,786 (Axis) | Axis Intelligence Research |
Snapshot as of September 4, 2026. Figures are as stated in Department of Justice announcements; several are stated as minimums, so AIRR is an estimate rather than a precise ratio.
According to Axis Intelligence Research, AIRR is 0.73 across the three prosecuted schemes with complete figures on the public record: for every dollar a victim company paid a fraudulent North Korean IT worker in salary, it spent roughly 73 cents auditing and rebuilding the devices, systems and networks that worker had touched. Combined direct exposure runs about $63,649 per victim company once salary and remediation are added together.
The enforcement snapshot
| Documented action | Date | Detail | Source |
|---|---|---|---|
| Coordinated nationwide action | June 30, 2025 | Searches of 29 laptop farms across 16 states; approximately 200 computers; 29 financial accounts and 21 fraudulent websites seized | DOJ |
| Laptop farm searches within that action | June 10 to 17, 2025 | 21 premises in 14 states, 137 laptops seized | DOJ |
| Earlier enforcement in same investigation | October 2024 | 8 locations across 3 states, more than 70 laptops and remote access devices recovered | DOJ |
| Facilitator sentencings | May 6, 2026 | Two 18-month sentences, described as the 7th and 8th laptop-farmer sentences in five months | DOJ |
| Documented salary earnings per operative | May 2022 advisory | Up to $300,000 annually per worker | FBI, Treasury and State advisory, cited by DOJ |
Note that the 137 laptops seized between June 10 and 17, 2025 are a subset of the approximately 200 computers reported for the whole June 2025 action, not an addition to it. The Wang indictment also states that operatives compromised the identities of more than 80 United States persons, and that between January 19 and April 2, 2024 an overseas co-conspirator accessed technical data marked as controlled under the International Traffic in Arms Regulations from a California defense contractor.
Marcus Chen, Cybersecurity: AIRR is the number to take to a hiring committee, because it reframes the problem as a procurement failure rather than a security failure. The security team did not fail to stop an intrusion. The company onboarded the intrusion, issued it a laptop and paid it twice a month. And the ratio explains why the cleanup is so expensive relative to the fraud: you cannot scope the blast radius of an employee. You have to assume every repository, ticket and credential they legitimately touched is compromised, which means re-auditing months of authorized activity. Identity proofing at hire is now a security control, and it belongs in the same budget line as endpoint detection.
Is Shadow AI the New Insider Channel?
The insider surface moved in 2025, and the DBIR’s data loss prevention telemetry is where it shows up first.
| Measure | Value | Sample | Source |
|---|---|---|---|
| Employees who are regular AI users on corporate devices | 45% | 2026 DBIR dataset | Verizon 2026 DBIR |
| Same measure, prior edition | 15% | 2025 DBIR dataset | Verizon 2026 DBIR |
| Users accessing AI services via non-corporate accounts on corporate devices | 67% | 2026 DBIR dataset | Verizon 2026 DBIR |
| DLP violations involving research and technical documentation sent to unauthorized AI | 3.2% | n=858,440 | Verizon 2026 DBIR |
Regular AI use on corporate devices went from 15% of employees to 45%, a tripling in a single reporting period, while 67% of users reach AI services through non-corporate accounts. Verizon records shadow AI as the third most common non-malicious insider action in its DLP dataset for 2025, a fourfold increase in share year over year. Source code is the most commonly submitted data type, followed by images and other structured data.
According to Axis Intelligence Research, this is the mechanism behind the divergence documented throughout this analysis. The dominant insider action of 2026 produces no forensic artifact a breach investigator would ever classify as a breach. An engineer pasting a proprietary function into a personal chatbot account generates a DLP event, a policy violation and a real intellectual property exposure, and generates nothing that will appear in a confirmed-breach corpus. For the identity side of the same shift, our zero trust statistics analysis covers the non-human identity ratios that agentic tooling is adding on top.
What Controls Reduce Insider Risk Cost?
The published savings figures are specific enough to build a business case from, and they favor prevention over response by a wide margin.
| Control or condition | Associated effect | Share of $19.5M baseline | Source |
|---|---|---|---|
| Privileged access management | $6.1M average saving | 31.3% | Ponemon Institute 2026 |
| User behavior analytics | $5.1M average saving | 26.2% | Ponemon Institute 2026 |
| Containment inside 30 days vs beyond 90 | $7.7M lower annual cost | 39.5% | Axis Intelligence Research from Ponemon 2026 |
| Average spend per incident on containment | $247,587 | — | Ponemon Institute 2026 |
| Average spend per incident on escalation | $39,728 | — | Ponemon Institute 2026 |
The Cybersecurity and Infrastructure Security Agency defines insider threat as the risk that an insider uses authorized access, intentionally or unintentionally, to harm an organization’s mission, resources, personnel, facilities, information, equipment, networks or systems — a definition that explicitly covers the negligent majority, and one worth adopting internally because it stops a program scoping itself down to malicious actors only. September is National Insider Threat Awareness Month, now in its eighth year, run by the Defense Counterintelligence and Security Agency with the National Insider Threat Task Force.
Frequency is moving the wrong way at the same time. Ponemon reports that 68% of organizations experienced between 21 and more than 40 insider incidents in 2025, up from 57% the year before. Adjacent Axis datasets cover the surrounding attack surface: data breach statistics for cost and industry benchmarks, the live data breach tracker for incident-level attack vectors, dark web statistics for where exfiltrated data is monetized, password statistics for the credential hygiene layer, and AI cyberattack statistics for attacker tooling.
Methodology
Collection. Every figure in this article was retrieved on September 3, 2026 from a primary document opened during production: the Ponemon Institute 2026 Cost of Insider Risks: Global summary published by Ponemon Institute, the Verizon 2026 DBIR PDF, three United States Department of Justice announcements dated June 30, 2025 and May 6, 2026, the IBM 2026 Cost of a Data Breach newsroom release, the CISA insider threat definition page, and the Defense Counterintelligence and Security Agency NITAM resource. No figure comes from secondary aggregation or from prior recall. Each has a row in the accompanying CSV carrying its source organization, document, URL and retrieval date.
Axis calculations. All derived figures are marked axis_calculated = yes in the dataset with a method_note containing the arithmetic. The three named metrics — AICP, AICS and AIRR — carry data_type = original_metric. All were computed in Python from published source values and all are reproducible by any reader from the cited documents.
Metric construction. AICP uses the two containment cost thresholds published in the same study year and the same population, so no cross-source normalization is applied; its daily rate spreads the gap evenly across the 60 days between the stated 30-day and 90-day thresholds, which is an assumption stated here rather than buried. AICS uses the stated headcount boundaries of open-ended size bands, which yields a floor for the small band and a ceiling for the large band; the gradient is therefore a minimum. AIRR sums only cases where a Department of Justice document states both a salary or revenue figure and a victim remediation figure; several are stated as minimums on both sides of the ratio. If components change in a future edition, each metric will be re-baselined openly and prior readings will not be rewritten.
A published discrepancy. The Ponemon study reports 7,490 incidents analyzed across 354 organizations, which is 21.2 per organization, while the same study’s per-category incident counts sum to 25.4 per organization — a 16.7% gap. The two figures likely count different populations, since the analyzed corpus and the benchmark average need not be the same set. Axis Intelligence Research publishes both rather than picking the more convenient one, and uses 25.4 for the blended cost calculation because it is the figure consistent with the published per-incident costs and annual totals.
Refusals. One calculation was attempted and rejected: a global insider-attributable breach cost derived from DBIR internal-actor prevalence and IBM or Ponemon cost means. It is recorded in the dataset with data_type = retracted and the reasoning in its method note.
Reporting boundaries. Ponemon figures come from 354 organizations selected because they experienced a material insider event, which is not a general population. DBIR figures come from a contributed corpus whose composition shifts as contributors join and leave. Department of Justice figures are as stated in charging and sentencing documents, and indictment allegations are allegations. These datasets are not interchangeable and are not merged anywhere in this article.
About This Dataset
File: insider-threat-statistics-2026.csv — 121 rows, 14 columns, UTF-8, comma-separated.
Columns: metric, value, unit, as_of_date, geography, segment, source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated, method_note, data_type.
Coverage: global and United States insider risk cost, incident frequency, containment time, root-cause mix, organizational size and sector segmentation, confirmed-breach internal actor prevalence, shadow AI exposure, and prosecuted fraudulent-insider employment cases, spanning 2024 through 2026 reporting periods.
License: Creative Commons Attribution 4.0 International (CC BY 4.0). Free to reuse, republish and redistribute with attribution.
How to Cite This Research
APA: Axis Intelligence Research. (2026). Insider threat statistics 2026: Cost, containment, and the detection gap. https://axis-intelligence.com/insider-threat-statistics/
MLA: Axis Intelligence Research. “Insider Threat Statistics 2026: Cost, Containment, and the Detection Gap.” Axis Intelligence, 4 Sept. 2026, axis-intelligence.com/insider-threat-statistics/.
Chicago: Axis Intelligence Research. “Insider Threat Statistics 2026: Cost, Containment, and the Detection Gap.” Axis Intelligence, September 4, 2026. https://axis-intelligence.com/insider-threat-statistics/.
Frequently Asked Questions
Why does insider risk cost keep rising while insider breaches fall in the DBIR?
They measure different events. Ponemon prices every material insider incident an organization can attribute internally, including negligence and misconfiguration that never produces confirmed data disclosure. The Verizon DBIR counts only breaches where disclosure was confirmed, and internal actors reached 12% of those in 2026 against 18% the year before. An insider incident with an invoice attached does not need to be a provable breach.
What is a defensible cost-of-delay figure for an insider incident business case?
$128,333 per day, per the Axis Insider Containment Premium. It derives from Ponemon’s published $14.2 million average annual cost where containment completes inside 30 days against $21.9 million where it exceeds 90 days, spread across the 60-day interval between those thresholds. The percentage form, AICP at 54.2%, travels better in a board deck because it needs no assumption about how cost accrues over time.
Should a mid-size company build an insider threat program at all?
The per-seat arithmetic argues yes. The Axis Insider Cost per Seat metric puts organizations under 500 employees at a minimum of $17,800 of annual insider risk cost per head against no more than $379 at organizations above 75,000, because incident fixed costs barely scale with company size. Ponemon reports 81% of organizations have or plan an insider risk program.
How do we detect a fraudulent remote IT worker before onboarding?
The Department of Justice record points at the mechanics rather than the person: company laptops shipped to an address that turns out to host multiple machines, unauthorized remote desktop software installed on issued hardware, and keyboard-video-mouse switches enabling overseas control of a device that reports as domestic. FBI and Treasury advisories from May 2022 onward publish red-flag indicator lists. The financial argument for identity proofing at hire is the Axis Insider Remediation Ratio of 0.73.
Is negligence or malice the bigger insider budget item?
Negligence, and by a wide margin. It accounts for 53% of incidents and $10.3 million of the $19.5 million annual average, against $4.7 million for malicious insiders. Per incident the two are nearly identical, at $747,107 and $742,125, so the difference is entirely volume: 13.8 negligent incidents a year against 6.3 malicious ones.
Does shadow AI count as an insider threat for reporting purposes?
Under CISA’s definition it does, because that definition covers unintentional harm through authorized access. Verizon records shadow AI as the third most common non-malicious insider action in its DLP dataset, with 45% of employees now regular AI users on corporate devices against 15% a year earlier, and 67% reaching those services through non-corporate accounts. Source code is the most frequently submitted data type.
Which sector carries the highest insider risk cost?
Health and pharmaceuticals, at $28.8 million in average annual activity cost, 47.7% above the $19.5 million global average. Technology and software follows at $24.2 million. Regionally, North American organizations absorb $24 million against $18.6 million in Europe.
What does privileged access management actually save?
Ponemon associates PAM with an average $6.1 million reduction in annual insider cost, equal to 31.3% of the global baseline, and user behavior analytics with $5.1 million, or 26.2%. These are observed differences across the benchmarked population rather than controlled results, so treat them as an upper bound on what a deployment should be expected to return.
How often should an organization expect an insider incident?
Every 14.4 days at the benchmark average, which is 25.4 material insider incidents per organization per year at a blended $767,717 each. Frequency is climbing: 68% of organizations reported between 21 and more than 40 incidents in 2025, up from 57% the previous year.
Can I reuse this data?
Yes. The dataset is published under CC BY 4.0. Cite as: Axis Intelligence Research, Insider Threat Statistics 2026, axis-intelligence.com.