Insider Threat & Human-Layer Security

Physical protection against the site’s assessed access and aerial paths (Chapter 11.2), a root of trust against a firmware implant (Chapter 11.4), a TEE against a privileged host (Chapter 11.5), a microsegment against lateral movement (Chapter 11.7), envelope encryption against a stolen disk (Chapter 11.8): each of these boundaries must also say which insider privileges it constrains. The insider can already be inside the boundary by design, holding a valid badge, a valid credential, a legitimate reason to touch the asset, and often the very privileges the control plane grants to keep the cluster running. Of RAND's 38 attack vectors, five are insider-recruitment routes under Human Intelligence (bribes and cooperation, extortion, candidate placement, organizational leverage attacks and organizationally approved access). Its experts also found that insider threats reach into many of the other categories: the human with access can socially engineer, exfiltrate, plant, disable or simply copy. RAND first places insiders in its threat model at SL3, one level above defenses against opportunistic attackers.

Applied to people, security trades in a different currency. The question is how much friction you impose on your own researchers and operators, and what that costs in the thing this guide cares about, goodput. Two-person rules add approval latency to the weight-bearing actions they gate. Compartmentalization fractures the collaboration that frontier research runs on. Behavioral monitoring collides with privacy law and with the trust that retains talent. Every control here buys down insider risk by spending something the business values, so spend it where the threat model justifies it and nowhere else.

Start with the base rates. They are worse than intuition suggests, and their cost keeps climbing. Across the general enterprise population, the 2026 Ponemon Cost of Insider Risks study (2025 data) puts the average annual cost of insider incidents at $19.5M across 354 organizations, up from $17.4M in 2024 (DTEX, Feb 2026). Negligent insiders drive ~54% of incidents and malicious insiders ~25%. Credential theft is ~21% of incidents but the costliest per event, at ~$842,462 (Ponemon / DTEX 2026 report, 2025 data). Verizon's 2026 DBIR, across more than 22,000 confirmed breaches, finds the human element present in ~62% of breaches. It also finds that the leading motive for deliberate misuse is now convenience (60%), ahead of financial gain (33%): the researcher emailing a file to a personal account to work from home (Verizon DBIR, 2026). Dwell time is the part that should frighten an AI operator. The average insider incident took 67 days to contain in 2025, down from 81 days in 2024, and stealing weights does not need 67 days. It needs the minutes it takes to copy a checkpoint.

Now apply the AI-data-center multiplier. The asset is not a customer database, which loses value the moment it leaks and can be partly mitigated afterward. It is a frontier model weight file: a single artifact, copyable in full, whose theft is permanent, whose value RAND treats as a national-security concern, and which an insider with legitimate access can carry out in one act. The standard enterprise insider playbook (DLP on email, a UEBA license, an annual training module) was calibrated for a world where the worst insider day costs low-seven-figures and is recoverable. The frontier-weights world inverts that. The worst insider day is a one-way door, and the people best placed to open it are the high-trust, high-access researchers and infrastructure engineers you cannot operate without.

The first fork comes before any technical control: who do you let near the asset at all, and how sure are you of them over time? Personnel security is a ladder, and each rung trades cost, hiring friction and legal exposure against assurance. The naive enterprise default is a one-time pre-employment background check followed by implicit lifetime trust. That is the floor, and for frontier weights it sits well below the threat model. A determined insider is rarely a bad hire on day one. More often a good hire's circumstances, loyalties or coercion exposure change in year three, and a point-in-time check cannot see that. Continuous evaluation addresses the time dimension: periodic re-investigation plus automated feeds (financial-distress signals, criminal records and, in some regimes, foreign-travel and contact reporting). It is also the control that collides hardest with privacy law and with a research culture that recruited on autonomy and trust.

Climbing this ladder has concrete costs. Higher screening tiers lengthen time-to-hire in a market where the scarce input is exactly the people you are screening. They shrink the candidate pool (a clearance-style requirement can exclude the majority of the global talent you would otherwise recruit). They also add ongoing program cost and a compliance surface that varies by jurisdiction. A single global standard over-controls in permissive jurisdictions and breaks the law in strict ones: EU and UK employment-monitoring and data-protection regimes sharply constrain what a US-style continuous-evaluation feed may even collect. The defensible answer is tiered. Apply deep screening and continuous evaluation to the small population with standing weight access and lighter controls to everyone else. The tiering is itself an argument for shrinking the high-access population in the first place.

The two-person rule is the canonical insider control because it turns a single point of human failure into a conspiracy requirement: no one person can perform the sensitive action alone. The fork is how strong to make it, and the strength is a literal dial with a goodput cost at every setting. At the weak end, advisory two-person logs and notifies but does not block. It deters the casual insider and leaves an audit trail at almost no cost, and it does not stop a determined one. In the middle, mandatory dual-approval requires a second authorized human to approve before the action proceeds, so an exfiltration or destructive change needs two colluding insiders, or one insider who successfully socially engineers the approver. At the strong end, cryptographic m-of-n splits the capability itself: a quorum of key-holders (Shamir secret sharing, threshold signatures, or hardware quorum on an HSM, Chapter 11.8) must each act before the weight can be decrypted, exported or signed. Collusion then has to defeat the cryptography, not just the policy.

The downstream cost is paid in latency and in the most expensive currency a frontier program has, researcher time. Make every weight read a dual-approval event and you put a human in the inner research loop. Make it an m-of-n ceremony and a 3am incident response waits on assembling a quorum. The art is to apply the strong rule only to irreversible, weight-bearing operations: export of a full checkpoint past the egress boundary, key rotation or revocation, deletion of the canonical copy, and deployment of a new weights version to production. Leave high-frequency, reversible, in-enclave operations on advisory or no two-person rule at all. Frontier labs are converging on a related pattern: no standing access to weight-bearing infrastructure. Engineers request time-limited, peer-approved access for each task, with a business justification (Anthropic's "multi-party authorization" design, described in its May 2025 ASL-3 activation report). The just-in-time grant is two-person by construction without taxing every action equally.

Treat the labs' published descriptions, Anthropic's multi-party authorization and OpenAI's insider-threat statement, as a floor, not as proof that either lab has an insider-grade posture. Anthropic's RSP (v2.2), in force when it activated ASL-3 in May 2025, explicitly left sophisticated and state-compromised insiders out of the ASL-3 security standard. RAND's SL3 threat model includes insiders. OpenAI's 2025 statement mentions investment in insider-threat safeguards for unreleased weights, but the controls are not published.

Separation of duties is the structural sibling of the two-person rule. Instead of requiring two people for one action, it ensures that no single role spans an end-to-end abuse path. The person who can train and export a model should not also administer the audit log that records the export. The person who provisions access should not review access grants, and the person who writes deployment automation should not be the sole approver of what it deploys. Collapse these and you have built one role that can both commit and conceal, the textbook insider precondition. The cost is organizational: more roles, more handoffs, and a standing temptation for a small, fast-moving team to re-merge duties "just to ship," which is exactly how the control quietly dies.

If you can stop weights from leaving, you constrain full-artifact theft, though sabotage, inference-mediated disclosure and authorized plaintext use remain. That makes egress an architectural choke point for the human layer, and it is why RAND's defensive recommendations center on hardening interfaces against weight exfiltration and centralizing weights on a small number of monitored, access-controlled systems. The design goal is one logical policy covering every sanctioned path a weight artifact can take out of the secure enclave, redundant gateways included. Each such path is inspected and rate-limited, every other path is physically or logically severed, and aggregate byte budgets and alerts are tested against artifact size, observation interval and approved distribution.

The forks are concrete. Removable media: ban it outright at weight-bearing tiers (no USB mass storage, no writable optical, ports disabled in firmware) or allow it under dual control. The ban is simple and strong, and occasionally infuriating for legitimate transfers. Outbound network: default-deny egress from the enclave with an explicit allowlist, inspection where the protocol and throughput permit it on every sanctioned path, and hardware-enforced rate caps at the enclave’s egress boundary: the front-end and the approved bulk-transfer paths, never the back-end collective fabric (Chapter 11.7). Inspection and caps at 400/800G on those egress paths are non-trivial to engineer and can throttle legitimate bulk distribution.

The attestation-gated release from Chapter 11.5 covers the in-use side: weights decrypt only into the policy-bound CPU/GPU workload recipient, so even an insider with the ciphertext and the storage credentials cannot turn them into a usable model off the sanctioned hardware. The guarantee lasts only while no one tampers with the host: memory-bus interposers costing about $159 to under $1,000 have forged Intel TDX attestation and pulled secrets from AMD SEV-SNP guests on hosts the attacker controlled and could open, and both vendors leave that attack class out of scope (TEE.fail, 2025; DDRop, 2026; Chapter 11.5). Physical access to weight hosts therefore needs the same two-person rule as weight export: seal and log every chassis, and escort and double-staff all maintenance. The standing tension is that the tighter you draw egress, the more you break the routine, legitimate movement of multi-terabyte checkpoints between research, eval and deployment. Teams that find the sanctioned path too slow will route around it, recreating the very exfiltration channel you closed.

Privileged Access Management (PAM) is the operational spine of insider control. It removes standing administrative credentials, brokers time-limited just-in-time grants, vaults and rotates secrets, and records privileged sessions so that an insider with legitimate root cannot act invisibly. PAM is what makes the just-in-time grant and the no-standing-access pattern real rather than aspirational, and it is where insider control and control-plane secrets management physically converge (Chapter 11.7; key hierarchy in Chapter 11.8). The decision is depth: session metadata only, full keystroke and command logging, or full screen recording of privileged sessions. Each step buys forensic and deterrent value and adds storage, review burden and employee-surveillance discomfort.

Behavioral monitoring / UEBA sits on top. It baselines normal access patterns per user and alerts on deviation: the researcher who suddenly pulls checkpoints they have never touched, the off-hours bulk read, access from a new device or geography, and the resignation-correlated spike in data access. CERT’s insider-risk guide lists downloading sensitive data within 30 days of resigning as a high-risk indicator (SEI, 2022). The value is real, and so are the limits. UEBA is a detection control, not a prevention control: it tells you an exfiltration is happening or has happened, against an asset where 'has happened' may already be unrecoverable. It also generates false positives that erode analyst trust and, over time, get tuned into silence. And it runs straight into the privacy ceiling. Pervasive employee monitoring is sharply constrained by EU/UK data-protection and works-council regimes, is a live cause of attrition among exactly the autonomous researchers you are trying to retain, and can poison the culture of trust that is itself a deterrence asset.

A Google insider case shows how these gaps play out. An engineer copied over 2,000 pages on Google's data-center hardware (TPU and GPU) and cluster software into a personal cloud account across about a year. Less than two weeks before he resigned, he downloaded them to a personal computer. A jury convicted him in January 2026 (US DOJ, Jan 2026). In August 2026 the judge acquitted him of the seven economic-espionage counts and kept the seven trade-secret counts (Courthouse News, Aug 2026). At sentencing on 1 September 2026 he received just under a year in prison plus two years' supervised release (KQED, Sept 2026). To get past DLP, the indictment alleges, he pasted content into a notes app and saved it as PDFs, and a colleague badged him into a US office while he was actually in China (NBC/AP, 2024). Each gap above shows up: DLP that allegedly missed reformatted content, a download just before resignation, and allegedly spoofed badge presence.

The fork is not whether to monitor but how much, scoped to which population, under what legal basis, and with what transparency. The answer legitimately differs by jurisdiction and by the sensitivity tier of the access.

One high-risk insider window is mundane: the gap between the moment a person's relationship with the organization ends (termination, resignation, contract expiry, project rotation) and the moment their access is actually revoked. A departing insider with a grievance and a still-live credential is the textbook malicious case, which is why CERT advises reviewing at least 30 days of a leaver’s activity before and after departure, and 90 days where the logs exist. The decision is whether offboarding is event-driven and automatic or ticket-driven and manual. In the automatic model, an HR status change immediately deprovisions every system through identity automation, revokes keys, invalidates sessions, disables badges and produces a provable revocation record. In the manual model, someone files a request, IT works the queue, and badges and SaaS grants linger for days. Manual offboarding does not fail loudly. It fails silently, leaving orphaned access that no one notices until an audit or an incident finds it. For weight-bearing access, same-day revocation is the floor, and the only reliable way to hit it is to make deprovisioning a consequence of the HR event rather than a task that depends on a human remembering.

Vendors and contractors are the same problem with weaker levers. They are inside your boundary: maintenance technicians in the data hall, integration partners with fabric access, managed-service staff with admin rights, and neocloud and colo operators whose own employees can reach your racks (Chapter 11.6). You typically cannot screen them to your own standard, monitor them under your own policy, or offboard them through your own HR system, so their access tends to outlive its purpose. The controls that work are structural: escort and supervision for physical access to weight-bearing zones, time-boxed and scoped credentials that expire by default, no shared accounts (every contractor action attributable to a named human), and contractual flow-down of your security obligations with audit rights. Facility-controls integrators (BMS, cooling, power) pose the same problem on the plant side. September 2026 CISA and FBI guidance asks owners to route integrator access over paths they can monitor, with each session approved where possible. It also asks them to name the authorized integrator staff in the service agreement, inventory every integrator-supplied device and its update path, and rehearse manual operation and a recovery plan that accounts for the integrator's role (Chapter 11.10). The fork is supply-chain-shaped (see Chapter 11.3 for hardware provenance), but the human-access piece is yours to own: a contractor with a standing admin credential and no expiry is an insider you did not hire and cannot fire.

Every control in this chapter can be defeated by a sufficiently motivated, sufficiently placed insider, so the last layer is not technical at all: it is deterrence and culture. Deterrence is the credible expectation that an insider action will be detected, attributed and consequential, and it is mostly free relative to its effect. Pervasive logging that employees know is comprehensive, attribution that reaches every action to a named human (no shared accounts, ever), a visible insider-risk program, clear and enforced consequences, and a trusted, low-friction reporting channel for colleagues who notice something all change the insider's expected-value calculation before any control is tested. The negligent majority (the ~54% of incidents that are carelessness, not malice) are addressed less by enforcement than by making the secure path the easy path, so that 'convenience misuse', the Verizon-leading motive, has nowhere to go.

The human layer is where security and the rest of the business are most directly opposed, and pretending otherwise produces worse security, not better. Over-control a research org and you do not get a secure lab. You get attrition of the people the controls were protecting, shadow workarounds that defeat the controls invisibly, and a culture of mutual suspicion that erodes the trust deterrence depends on. Under-control it and the base rates above tell you what happens. No setting optimizes both. There is only a defensible, threat-model-driven balance that you revisit as asset value, the regulatory environment and the threat landscape move, implemented with enough transparency that the people inside the boundary understand why the friction exists. The governance regime that ratifies these tradeoffs and the metrics that show they are working live in Chapter 11.11; the detection and response machinery that catches the insider who beats the controls lives in Chapter 11.12.