# Insider Threat **Entity class:** National-security and cybersecurity concept ## Definition An **insider threat** is the danger that a person with authorized access or placement will use that access, intentionally or unintentionally, to harm an organization or the security of the United States. National-security doctrine expressly includes harm through espionage, terrorism, unauthorized disclosure, or degradation of resources and capabilities. ## Relevance to this collection It is the literal doctrinal bridge to [[wiki/Human CVE|Human CVE]]: the human is part of the protected system, and authorized placement can become the condition that makes an [[wiki/Attack Path|attack path]] possible. ## Relationships - **master collection:** [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]]. - **sociotechnical system:** [[wiki/Sociotechnical Attack Surface|Sociotechnical Attack Surface]]. ## Simple Reminders, Quotations, and Thoughts > "Treating frontier closed and open weight models like insider risks is a way to build such a system. Not because they are necessarily malicious, but because any sufficiently capable actor with access to important systems can make mistakes or be compromised, and the architecture of containment and control must account for that." > **— Satya Nadella**, *Models as Insider Risks in the Super Intelligence Era, October 10, 2026* [[reminders/AI Control/Treat Frontier Models Like Insider Risks by Satya Nadella|Treat Frontier Models Like Insider Risks by Satya Nadella]] ## Sources / Provenance - [Defense Counterintelligence and Security Agency, *Exploitation of Insider Access*](https://www.dcsa.mil/Portals/128/Documents/CI/DCSA_CI_Best_Practices_booklet.pdf) (accessed 2026-09-23). **As of:** 2026-09-23