How Insider Threats Are Evolving in 2025

Keith Shaw: In the world of cybersecurity, teams often focus on external threats—hackers or nation-states trying to breach systems. What’s often overlooked, however, are insider threats, which can range from corporate spies to disgruntled employees or other bad actors.

On this episode of Today in Tech, we're checking in on the latest trends and tactics for identifying the bad apples—and learning how the bad guys are recruiting new help. Hi, everybody, welcome to Today in Tech. I'm Keith Shaw.

Joining me on the show today is Ryan LaSalle, CEO of Nisos. Welcome to the show, Ryan. Ryan LaSalle: Keith, great to be here. Keith: All right. So you're one of those cybersecurity people—you’re probably paranoid all the time.

Is that the case, or are you able to sleep at night?

Ryan: I sleep pretty well, but I try to balance optimism and paranoia in equal measure. Keith: All right.

So, the reason I’ve got you on the show, Ryan, is that there’s been a bunch of recent events—like the discovery of North Korean nationals working remotely for U.S. companies in IT roles. We wanted to talk about this insider threat situation in 2025.

Another point you brought up before the show was how some bad actors are actively recruiting insiders. When did you start noticing this becoming a bigger issue for companies? Is this still a post-pandemic phenomenon, or is something else going on?

Ryan: Throughout my nearly 20-year career in cybersecurity, insider threats have consistently been a key issue for companies to manage. But they’ve evolved significantly. We’ve seen everything from high-visibility national security issues—like leakers and double agents—to disgruntled workers laying traps in anticipation of being fired.

Then you have external hackers stealing credentials and impersonating insiders, leaving security teams to figure out whether it's the real employee or someone who has hijacked their identity.

One trend that’s really escalated post-pandemic is what we call "poly-working fraud"—where people hold multiple jobs, sometimes even with competitors, without employer approval. And as you mentioned, North Korea has made headlines recently by using employment scams to launder money and circumvent sanctions.

They place fraudulent workers into remote positions and use their salaries to fund things like their nuclear weapons program.

Keith: Is that because of the flexibility introduced by remote work during the pandemic? Maybe bad actors saw remote work as an easier entry point than trying to physically infiltrate a company?

Ryan: It's much harder to pretend to be someone you're not when you have to meet people in person. So yes, remote and hybrid work environments have made it easier for these actors to exploit vulnerabilities.

Keith: One of the most fascinating things to me is how they're now recruiting. Can you talk about what’s happening there? It’s almost like an Indeed.com or ZipRecruiter for bad actors, right? Ryan: Absolutely.

Most insider threat programs focus on monitoring behavior and access within the organization—which makes sense. But we’re seeing early signs of insiders being recruited even before they’re on the payroll, or offering up their access for financial gain. This activity often happens in closed groups or fringe social media spaces.

In the last quarter alone, we saw several companies targeted by recruiters seeking insiders—people with access willing to provide credentials, install malicious software, or steal data. Sometimes, these groups even advertise whole rings of insiders and actively try to recruit more people.

It’s very much like a matchmaking service between attackers and insiders.

Keith: And they’re doing this pretty openly, right? They’re not even trying to hide it?

Ryan: Not exactly openly—they’re not posting on X or Facebook. But they are active in hard-to-find forums. You need to know where to look. Still, they’re not being subtle. They’ll name the companies they’re targeting outright.

Keith: So, if I wanted to sabotage a company from the inside, I wouldn’t find these opportunities on Facebook—I’d have to dig deeper. And these aren’t small-time targets either. Amazon’s one of them, right?

Ryan: Yes, we wrote about Amazon. But we’re also seeing this with retailers—particularly around chargeback and payment fraud. Any company with critical systems is a target: telecoms, cloud providers, managed service providers—you name it.

Keith: And they’re offering bonuses and other incentives to do this? Ryan: Yes.

It’s financially motivated. But the payments aren’t huge. People aren’t retiring to the beach—it’s more like a side hustle.

Keith: Do you or your team ever talk directly with insider actors to understand their motivations?

Ryan: Some of our open-source investigators and intelligence professionals do. To do their job effectively, they need to understand the ecosystem and motivations involved. So yes, under different personas, our team will engage with these actors to gather intelligence. I don’t personally—but the experts on my team do.

Keith: Insider threats often stem from disgruntled employees—especially during layoffs or firings. I saw a story where an IT worker sabotaged a system after being laid off and ended up in jail. Are we seeing more of this kind of thing, or are those just headline-grabbers?

Ryan: It’s noteworthy but not necessarily more frequent. Disgruntlement is a major motivation, but there are others—like financial distress. When people are under pressure, they make bad decisions. Another factor is disengagement—after a reorg, people might feel isolated and unsupported, and that makes bad decisions more likely.

Mental health and wellbeing are increasingly concerning too. During the pandemic, companies emphasized grace and care. Now, there’s been a shift back to harder corporate cultures, which may leave some employees feeling unsupported. If companies care less, they may see a rise in—let’s call it—“disgruntledness.”

Keith: I’m not blaming companies, but clearly, if they care less about employee wellbeing than they used to, that could fuel more insider threats. What signs should companies look for?

Ryan: Different companies will have different risk profiles, but some common indicators are: Declining performance Changes in demeanor or behavior Social isolation The only way to catch these is through strong relationships between management and staff.

This also helps detect fraudulent employees—like North Korean operatives—who might slip through if no one’s paying attention. Another area is family duress. Take China’s "Thousand Talents" program—Chinese nationals working in strategic U.S. industries might be pressured by the CCP through their families. It puts good people in impossible situations.

Companies need to be aware of this risk—but without becoming xenophobic. That’s part of what makes insider threat management so complex.

Keith: Before the show, you also mentioned the difference between malicious and non-malicious insider threats. Can you expand on that, especially how employers might distinguish between the two? Because if my performance dips, it might just be personal issues—not that I’m planning something harmful.

Ryan: The difference is intent. A malicious insider is deliberately trying to do harm, while a non-malicious one is making mistakes—accidentally sending sensitive data, clicking phishing links, etc.

For the accidental insiders, training and good security design can help—make it easy to do the right thing and hard to do the wrong thing. But you can’t train away malicious intent. For both types, you need strong data monitoring to detect when controls are failing or being bypassed.

But the prevention strategy is different—non-malicious insiders need education, while malicious ones need detection and response.

Keith: Should companies assume they already have insiders—or that they might, even if their employees seem happy? Ryan: Absolutely.

Not every company has a malicious insider at all times, but insider risk is always present. It’s like the old saying: there are two types of companies—those that have been breached and those that don’t know it yet. Even accidental mistakes can expose data or cause reputational harm.

Many organizations struggle with the cultural shift from “we trust everyone” to “we trust, but verify.” And these risks aren’t limited to cybersecurity. The same dynamics apply to things like financial fraud, workplace harassment, and more.

Keith: But there’s also the other extreme—companies that spy on employees 24/7. How do you strike that balance? How do you communicate “we trust you” while still putting safeguards in place?

Ryan: It’s about transparency and trust. In regulated industries, people already assume their communications are monitored—it’s a legal requirement. Most employees should expect that anything done with company resources is subject to monitoring.

That said, there’s a difference between monitoring your corporate Teams usage and snooping through your Gmail on a personal phone. The goal is to protect the business while respecting boundaries. Keith: Right.

I get that, having covered this space for a long time. But the average employee may not realize that their work emails or Slack messages can be monitored. You also look at public social media. Should companies be doing that too?

Ryan: Let’s start with the cultural part—trust is key, even while monitoring. How you conduct investigations sets the tone. If you assume bad intent from the start, you’ll erode trust. If you approach it with curiosity and care, people feel respected.

That’s why HR should always be a partner in insider threat programs. They bring the human perspective and help ensure respectful handling of issues. This builds trust instead of paranoia.

Keith: And what about monitoring external social media—should companies do that themselves or outsource it? Ryan: It depends.

Some companies have the talent in-house; others work with firms like ours. You’re looking for “indicators of concern,” like: Collusion Inappropriate access Too many privileges From the outside, it could be things like financial duress, criminal activity, or foreign intelligence ties.

Sometimes employees don’t realize they’re exposing themselves—or the company—by who they associate with. So it’s also about helping them understand that risk.

Keith: But do people really post that kind of thing? Like, I wouldn’t share that I’m in debt on social media. So how do companies even find that stuff?

Ryan: Usually, it starts with internal indicators—like unusual behavior or access patterns. That prompts us to investigate further. Then we might find criminal activity, espionage, money laundering, malware sales, etc. These aren’t visible on mainstream platforms—they’re happening in closed or underground forums.

But yes, we look to see if individuals are participating in those communities.

Keith: So when you talk about social media, you’re really talking about dark web forums or fringe spaces—not Instagram or Twitter? Ryan: Correct.

The big platforms still have issues, but they're actively fighting things like illicit drug trade and child exploitation. If your employee is involved in that, you'd want to know. But most of the recruiting and malicious behavior happens in harder-to-access forums—on the deep or dark web.

Keith: And the bad guys use those same spaces for recruitment, right? It’s like a constant battle. Ryan: Exactly.

It’s an arms race. Defenders are always trying to gain an advantage and catch threats before they cause real damage.

Keith: Whose job is all this? Is it the CISO, or someone else on the IT team?

Ryan: It usually falls under information security or corporate security. Often there's an insider threat team or protective intelligence group, working independently or with external partners like us.

Keith: What does the future hold? Are insider threats going to increase? Or could things level off with better policies?

Ryan: Insider threats will always be an issue. The tactics and motivations will evolve — North Korea’s employment scams are a great example. And with AI and deepfakes, things will get even harder to detect.

Just like in broader cybersecurity, we’ll see a few companies manage this really well, a few ignore it, and most fall somewhere in the middle — trying to mature their capabilities. As this risk vector grows, more companies will respond, trying to contain the damage to a manageable level.

Keith: Ryan LaSalle, thanks again for joining the show and shedding light on this important topic. Great stuff. That’s all the time we have for this week’s episode. Be sure to like the video, subscribe to the channel, and drop your thoughts below if you’re watching on YouTube.

Join us every week for new episodes of Today in Tech. I’m Keith Shaw — thanks for watching.