Follow the Access · 21 — The Insider: The Attacker Who Was Already Given the Keys

Follow the Access — Case 21. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

Twenty cases have followed attackers trying to get access the organization did not want to give them — guessing, phishing, exploiting, buying, stealing their way past the defenses. This case follows an attacker who needed none of that, because the organization gave them the keys. The insider is an employee, a contractor, a systems administrator — someone who was vetted, hired, trusted, and handed legitimate credentials to do their job — and who then turned that trust against the people who granted it. There is no intrusion here, because there is nothing to intrude: the insider is already inside, already authorized, already holding the access that every other case in the register worked so hard to obtain. They did not break in. They were let in, on purpose, and they betrayed the trust that let them.

This inverts the entire logic of the register, and of security itself. Every defense the register has recommended — the strong password, the multi-factor authentication, the patched software, the firewall, the perimeter — is built on a single assumption: that the attacker is an outsider trying to get in, and the defense's job is to keep them out. The insider makes that assumption worthless, because the insider was never outside. Multi-factor authentication does not help when the attacker holds the second factor legitimately. Patching does not help when the attacker needs no exploit. The perimeter does not help when the attacker is standing inside it, badge in hand, doing what looks exactly like their job. The insider is the vector that attacks not the walls but the trust the walls were built to protect, and there is no wall between an organization and the people it decided to trust.

So the disposition is WIPED, because the insider's most feared form is the destroyer — and specifically the administrator with the deepest access, who on being fired or feeling wronged uses that access not to steal but to sabotage: to delete the data, destroy the backups, and wipe the systems on the way out. This is the insider at their most dangerous, because they hold the keys not only to the data but to its recovery, and can ensure the destruction is total. It must be said plainly, as with phishing: the honeypot beneath these words cannot see this vector, because the insider generates no intrusion for a sensor to catch. This is the case about the attacker who was already given the keys, and about the betrayal that no perimeter defends against.

1. The Vector That Inverts Everything

Begin with the structural inversion, because it is what makes the insider unique and uniquely hard, and it is worth stating with full force. Every other vector in this register is a story of an outsider overcoming a barrier: the barrier of a password, of a patch, of a user's skepticism, of a firewall. The whole architecture of security is a set of barriers between the trusted inside and the untrusted outside, and every case so far has been about an outsider finding a way through one of those barriers. The insider is not an outsider who found a way through. The insider is someone the organization deliberately placed on the trusted side of every barrier, because they had to — you cannot run an organization without granting people access, and the people you grant access to are, by definition, inside all your defenses.

This means the insider defeats security not by defeating any control but by rendering the controls irrelevant, because the controls are aimed the wrong way. Consider each defense the register has leaned on. Multi-factor authentication is meant to stop an attacker who lacks the second factor — but the insider was issued the second factor, legitimately, as part of their access. Patching is meant to close the flaws an attacker would exploit — but the insider does not exploit anything; they log in normally. Perimeter defense and network monitoring are meant to catch intrusion from outside — but the insider is inside, and their activity originates from where trusted activity is supposed to originate. Every one of these controls assumes the attacker is unauthorized, and the insider's defining property is that they are authorized. You cannot lock out someone you gave a key to; you can only hope they do not use it against you, and take measures to limit and detect it if they do.

The consequence is that the insider attacks the foundational, unavoidable assumption of all security: that the people you trusted are trustworthy. Security is, at bottom, a structure built on top of trust in people — trust that the administrator will administer rather than sabotage, that the employee will work rather than steal, that the contractor will do the job rather than betray it. That trust is not a weakness to be eliminated; it is a necessity, because no organization can function while trusting no one. But it is also the one thing no technical control can secure, because the control itself is administered by trusted people and granted to trusted people. The insider is the vector that lives in this irreducible gap — the gap between the necessity of trusting people and the impossibility of guaranteeing they deserve it — and it is a gap that cannot be closed, only narrowed and watched.

2. Two Faces: The Betrayer and the Bought

Now the two forms the insider takes, because they are different in origin even as they share the defining feature of legitimate access, and both are growing. The first and more familiar is the insider who turns of their own accord: the malicious insider, motivated by grievance, greed, ideology, or desperation. This is the disgruntled employee passed over for promotion, the administrator about to be fired, the worker who feels wronged and wants revenge, or the one who sees a chance to profit and takes it. Their access was granted in good faith and their intent curdled — the trust was real when it was given and became a weapon when the person holding it decided to turn it. The malicious insider is the classic case, documented in decades of prosecutions and studies, and the most dangerous version, as the disposition will show, is the privileged administrator whose grievance turns destructive.

The second form is newer and, in its way, more unsettling: the recruited insider, an ordinary employee turned not by their own grievance but by an outside actor's money. Criminal and state actors have discovered that the cheapest way past a perimeter they cannot breach is to pay someone already inside to breach it for them, and they advertise for exactly this — soliciting, on forums and messaging channels, employees willing to sell their access, plant a payload, exfiltrate data, or run a piece of malware from within their own organization, for a fee. This turns the insider vector into a purchasable service and connects it directly to the access-broker economy of Case 10: rather than buy a foothold that a hacker produced by breaking in, the buyer commissions a foothold that an employee produces by betrayal. The recruited insider is the access market reaching through the walls — an outside attacker who solves the problem of the perimeter not by defeating it but by paying someone on the other side to open a door. It means that any employee with valuable access is a potential recruitment target, and that the perimeter can be defeated not by any technical means but by a bribe to the right person.

Together these two faces make the insider a broad and rising threat, because they multiply the ways trust can fail. The organization must worry not only that a trusted person might turn on their own — a risk it can partly manage through culture, treatment, and monitoring — but that a trusted person might be recruited by an outside adversary with money and patience, which is much harder to prevent, because the recruitment happens outside the organization's sight and the recruited employee may be an otherwise unremarkable worker with ordinary access that happens to be valuable to the buyer. Both faces share the fatal feature: the access is legitimate, the person is trusted, and the betrayal is invisible to every defense aimed at outsiders. Whether the insider turned themselves or was bought, the organization faces the same impossible problem — an attacker it cannot lock out, because it let them in.

3. WIPED — The Destroyer With the Keys to Recovery

Now the disposition, and the register records WIPED because the insider's most catastrophic form is the destroyer, and the destroyer's unique power is that they often control the very means of recovery. An insider can do many things with betrayed access — steal data (a harvest), plant a backdoor for a buyer (a resale) — and those happen. But the disposition this case owns is the one no outsider can match: the trusted administrator who uses the deepest legitimate access not to take but to destroy, and who is positioned to destroy completely.

Consider what a systems administrator legitimately controls. Not just the data, but the infrastructure that holds it; not just the systems, but the backups meant to restore them; not just the machines, but the recovery mechanisms an organization would rely on after any disaster. This is access granted for the best of reasons — someone has to be able to manage and recover the systems — but it means the administrator holds the keys to both the kingdom and its reconstruction. When such a person turns destructive, they can ensure the destruction is total, because they can reach and destroy the very things that would allow recovery. The archetype, well-documented in prosecutions, is the administrator who, on being fired or feeling wronged, deletes the production data, then deletes the backups so it cannot be restored, then wipes or sabotages the systems so they cannot even be rebuilt quickly — a scorched-earth destruction of an organization's digital existence, carried out by the one person trusted to protect it. There are numerous cases of exactly this: administrators who used still-valid or secretly-retained access after departure to inflict severe, sometimes company-threatening damage, wiping servers and destroying the backups in a single coordinated act of sabotage.

This is why the disposition is WIPED and why the destructive insider is so uniquely feared. Against most destructive attacks, the defense is backups — the register has said so repeatedly, that offline backups are the survival plan against ransomware and wipers. But the destructive administrator is precisely the person who controls the backups, and so is precisely the attacker who can defeat that last defense, deleting the recovery path along with the data. The insider destroyer is the register's clearest case of a threat that can make destruction irrecoverable, because they were trusted with the keys to recovery itself. And the harm is not merely data loss; it is often existential — organizations have been driven to the brink or out of business by a single insider who destroyed both their systems and their ability to rebuild them, in an afternoon, using access the organization itself had granted. The disposition is WIPED because the insider, at their most destructive, does not just wipe the data — they wipe the possibility of getting it back, which is a power only someone trusted with everything could hold.

4. The Vector the Sensor Cannot See

The register must pause here, as it did with phishing, to name honestly a limit of its own instrument, because the limit is not incidental — it is a direct expression of what makes the insider so dangerous. The honeypot beneath these words cannot observe this vector, and the reason cuts to the heart of the case. A honeypot is a sensor for unauthorized access from outside: it presents itself as a target and records the intrusions that come for it — the brute-force attempts, the exploits, the malware deliveries, all the signals of an outsider trying to get in. The insider generates none of these. Their access is authorized. Their origin is inside. Their activity, at the level any sensor can observe, is a trusted person using legitimate credentials to do things they are permitted to do. There is no intrusion signal, because there is no intrusion.

This blindness is not a gap in the honeypot's coverage that better instrumentation would close; it is a property of the vector. The insider is invisible to intrusion detection for the same reason they are invulnerable to perimeter defense — they are not intruding and not at the perimeter. A network sensor watching for attacks sees the insider doing legitimate work, because that is exactly what the insider's activity looks like right up until the moment of harm, and often even during it: deleting data one is authorized to delete, downloading files one is permitted to access, logging in with credentials one legitimately holds. The distinction between an administrator doing maintenance and an administrator preparing to sabotage is not visible in the access itself; it is only visible in the intent, and intent is not a signal any sensor reads. The register's honeypot, which has grounded so much of this series with first-hand data, is simply silent about the insider, and that silence is itself the most important thing the sensor can tell you: it means the insider defeats the entire model of watching the perimeter for attacks, because the insider is not an attack from the perimeter.

Naming this honestly matters, because it would be easy for a register built on a honeypot to over-weight the vectors the honeypot can see — the credential attacks, the malware, the scanning — and under-weight the vectors it cannot. The insider is a vector the sensor cannot see, and the register includes it prominently precisely so as not to mistake its instrument's blind spots for the absence of threats. The most dangerous attacker may not be the one hammering at the door that the sensor watches; it may be the one already inside, whom no sensor watches, doing what looks like their job. The honeypot's silence about the insider is not a failure of the honeypot; it is the honeypot correctly reporting that this threat lives where it cannot look — inside the trust, where the only sensors that could catch it are the ones watching how trusted people actually behave.

5. Narrowing and Watching a Trust You Cannot Remove

The register owes the defense, and the insider demands its most humble version, because there is no wall to build — the attacker is already inside the walls, and the trust that lets them in cannot be eliminated without ceasing to function. The defense, therefore, is not prevention but limitation and detection: not "keep the insider out," which is impossible, but "make any betrayal reach less far and show more." It runs on four disciplines.

The first is least privilege and need-to-know: grant every insider only the access their specific role requires, and no more, so that if any one person betrays their trust, the damage is bounded to their narrow scope rather than the whole organization. Most insiders, malicious or recruited, can only harm what they can reach, so shrinking what each person can reach shrinks the harm any betrayal can do. The second is separation of duties, which is the specific antidote to the destructive administrator: arrange the most dangerous actions — deleting backups, altering critical infrastructure, moving large amounts of data — so that they require more than one person to authorize or execute, so that no lone insider can carry out total destruction by themselves. If deleting the backups requires two administrators acting together, a single sabotaging administrator cannot delete them. The third, following directly, is immutable, offline backups held outside any single administrator's control — the defense against the destroyer's ability to delete the recovery path. If the backups are write-protected and outside the reach of even the most privileged insider, then the destructive administrator can wipe the production systems but cannot wipe the means of rebuilding them, and the WIPED disposition becomes survivable rather than existential.

The fourth discipline is watching, and it is the same behavior-based detection the valid-account case required, applied to the trusted. Since the insider's access is legitimate, they cannot be caught by the presence of an attack; they can only be caught by the abnormality of their behavior — a person accessing far more data than their role normally touches, downloading unusual volumes, working at strange hours, or reaching for systems they have no business reason to reach. Behavioral monitoring and analytics aimed at detecting anomalous use of legitimate access are the closest thing to a sensor for the insider, and while they are imperfect and noisy, they are the only technical measure that can catch a betrayal in progress. And underpinning all of it is rigorous offboarding: the moment a person's relationship with the organization ends — especially a privileged one, especially a contentious departure — every credential they hold must be immediately and completely revoked, because retained access is the sabotaging administrator's weapon, and the fired admin who still has a working login is the destructive insider waiting to happen. The register's honest summary is that the insider cannot be defended against the way the other vectors can, because the attacker is trusted; the best that can be done is to trust as few people with as little as possible, to require more than one person for the most destructive acts, to keep the recovery path beyond any single person's reach, to watch how trusted people behave, and to revoke trust the instant it ends. It is a defense of narrowing and watching, not walling — because against the person you gave the keys to, there is no wall.

6. The counter-narrative, steelmanned

The strongest objection to this case is that the insider is not a "vector" in the register's sense at all — it is a personnel and human-resources problem, an issue of hiring, culture, and management, misfiled in a technical register of access.

The argument runs like this. Every other case in the register describes a technical mechanism — a protocol, a flaw, a malware family, a market — that can be analyzed and defended technically. The insider describes none of that; it describes a person choosing to betray their employer, which is a matter of human motivation, workplace grievance, and character, not of technology. The defenses, the objection continues, are managerial (treat employees well, vet them carefully, offboard them cleanly) rather than technical, and belong in an HR manual or a corporate-governance guide, not a threat register about how systems are accessed. And the "recruited insider" framing, the argument adds, is really just bribery, an ancient human crime that has nothing specifically to do with cybersecurity. On this view the insider is a real problem but a categorically different one, dragged into a technical register where it does not fit.

The register concedes the human dimension and denies the misfiling, because the objection mistakes the insider's cause for its nature. Yes, the insider's motivation is human — grievance, greed, recruitment — and yes, some defenses are managerial; the case says so and treats the human dimension seriously rather than pretending it away. But the register's subject is access, in the full sense of how it is obtained, held, and abused, and the insider is a way of holding and abusing access that is every bit as consequential as the technical vectors, and that interacts with them directly. The recruited insider is not merely "bribery"; it is the access-broker economy — a thoroughly technical, cyber-native market — commissioning a foothold, which makes it a cyber threat that happens to be delivered through a human rather than an exploit. The destructive administrator's sabotage is a technical act with technical defenses (separation of duties, immutable backups, offboarding) that the case specifies concretely. And the deepest reason the insider belongs in the register is precisely that it defeats the technical model the other cases assume: a register of access that catalogued twenty ways outsiders get in and omitted the one attacker who was already inside would be presenting a dangerously incomplete picture, one that reinforces the very perimeter-centric thinking the insider exploits. The insider earns its case not despite being partly a human problem but because it is the vector that proves access security cannot be purely technical — that the foundational layer beneath every technical control is trust in people, and that this layer, too, is an attack surface. Omitting it because it is uncomfortable to model would be exactly the blind spot, the mistaking-the-sensor's-limits-for-the-threat's-absence, that the case warns against.

7. Disposition — WIPED

Case 21 followed the insider — the employee, contractor, or administrator who never broke in because the organization gave them the keys, and who turned that legitimate access against the grantor. It inverts the entire logic of the register: the insider is not an outsider overcoming a barrier but a trusted person on the inside of every barrier, against whom multi-factor authentication, patching, and the perimeter are all irrelevant, because every one of those controls assumes the attacker is unauthorized and the insider is authorized. It comes in two faces — the malicious insider who turns of their own grievance, and the recruited insider bought by an outside actor, the access-broker economy reaching through the walls — and both share the fatal feature that the access is legitimate and the betrayal invisible to every defense aimed at outsiders. As with phishing, the register's own honeypot cannot see it, and that silence is the point: the insider defeats the whole model of watching the perimeter.

The disposition — the foothold's fate — is WIPED, because the insider's most catastrophic form is the destroyer, and specifically the administrator whose deep, legitimate access includes control over the backups and recovery mechanisms themselves. On being fired or feeling wronged, such an insider can delete the data, destroy the backups so it cannot be restored, and wipe the systems so they cannot be rebuilt — a total, often existential destruction carried out by the one person trusted to protect the systems, defeating even the backup defense that stops ransomware, because they hold the keys to recovery too. The insider destroyer is the register's clearest case of a threat that can make destruction irrecoverable.

The defense cannot be a wall, because the attacker is inside the walls; it is a discipline of narrowing and watching a trust that cannot be removed: least privilege so any betrayal reaches little, separation of duties so no lone insider can destroy everything, immutable offline backups beyond any single administrator's control so the recovery path survives, behavioral monitoring for anomalous use of legitimate access, and rigorous offboarding so departed trust is revoked the instant it ends. The vectors do not lie, but this vector does not come to the sensor at all — it was already inside, holding the keys the organization handed it, and the betrayal looked exactly like the job right up to the moment the data and its backups were gone together. We do not judge. We record. We let people judge — and then, if they are wise, trust as few with as little as possible, and keep the recovery path where no single betrayer can reach it.

Follow the Access continues. Case 21 disposition: WIPED. Confidence: HIGH — the insider-threat category and its cost/detectability profile are documented by CISA and the CERT insider-threat research program; the sabotaging-administrator archetype is well-established in DOJ prosecutions of insider sabotage; and the recruited-insider trend (paid insider recruitment via forums/messaging channels) is documented and connects to the access-broker economy of Case 10. The register openly notes that its own honeypot cannot observe this vector — a scope fact stated as such, as with phishing (Case 04). The WIPED disposition reflects the destructive-insider outcome and the administrator's unique control over recovery mechanisms; the defense (least privilege, separation of duties, immutable backups, behavioral monitoring, offboarding) follows CISA/CERT insider-threat mitigation guidance. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the trusted person, the keys they were given, and the recovery path destroyed by the one who held it.