The insider for hire: how criminals and states now buy their way in
The insider for hire: how criminals and states now buy their way in
Insider risk used to mean the disgruntled employee. In 2026 it increasingly means the employee who has been offered money, by a ransomware gang or a foreign intelligence service, through an app on their phone.
By TiNYg Editorial · 6 November 2026
Every article in this series has, at some point, arrived at the same vulnerability: people. Russian and Iranian services recruit proxies on Telegram; Islamic State and nihilist networks recruit teenagers on gaming platforms; criminal groups buy access instead of hacking for it. The common denominator is that the cheapest way past a well-defended perimeter is someone already inside it.
The evidence
■Mimecast’s State of Human Risk 2026 report found that malicious insider incidents now account for 42 per cent of insider events, level with accidental ones for the first time. The share of organisations reporting a rise in malicious insider activity grew from 35 to 44 per cent in two years.
■Threat intelligence firm Flashpoint identified more than 12,600 insider-related posts on illicit forums and channels in July 2026 alone, with telecoms, retail and finance most targeted. Most are insiders advertising access for sale, or criminals offering to buy it.
■In October 2026, US authorities warned again that North Korean IT workers are obtaining remote jobs under false identities, including with defence contractors, to fund the regime and gain access.
■In the UK, a man was charged in September with sharing the locations of drone factories with people linked to Russian military intelligence and offering to carry out sabotage (see article 3).
The physical security dimension
Most insider risk programmes are run from the cyber or HR function and focus on data. For TiNYg’s membership, the physical insider deserves equal weight. Contract guards, cleaners, maintenance engineers, event staff, drivers and agency workers have unescorted access, out-of-hours presence and detailed knowledge of security routines. They are often lower paid, employed through layers of subcontracting, and vetted to a lower standard than permanent staff. They are exactly the people a hostile actor offering a few hundred pounds for photographs, a door left on the latch or a USB stick plugged in would approach.
The professional view
The UK’s National Protective Security Authority has long argued for a personnel security approach built on three layers: robust pre-employment screening, ongoing personnel security (because circumstances change after hiring), and a security culture in which staff feel able to report approaches and concerns without fear. That third layer is the one most often neglected, and it is the one that would catch an employee being groomed on Telegram.
A good insider programme is not surveillance of the workforce. It is a combination of proportionate controls, clear reporting routes and managers trained to notice changes in behaviour: financial distress, unexplained wealth, unusual interest in areas outside someone’s role, or attempts to access systems out of hours.
What to do now
■Extend vetting and security briefings to contractors and agency staff with privileged physical access, and write these requirements into contracts.
■Tell staff explicitly that they may be approached online, what it looks like, and that reporting an approach will be treated as a positive act.
■Verify identity carefully for remote hires, especially technical roles.
■Link HR, security and IT so that leavers’ access, both physical and digital, is removed the same day.
■Review who can disable alarms, cameras or access control, and log every use of that ability.
Sources
▪ Mimecast: State of Human Risk 2026
▪ Security Boulevard on Flashpoint insider report (Aug 2026)
▪ Federal News Network on cleared employees and North Korean IT workers (Oct 2026)
The Conversation is TiNYg’s members’ blog. Members and premium partners are invited to respond to, extend or challenge this article. Get in touch to contribute.
The Conversation
No. 1Martyn’s Law: the last six months before the clock starts
No. 2After Leipzig: the drone threat is no longer theoretical
No. 3Sabotage-for-hire: why your company is now on a hostile state’s target list
No. 4Younger, faster, less ideological: the new radicalisation curve
No. 5The chatbot in the attack cycle: what the evidence on AI and terrorism actually shows
No. 6From Heaton Park to HAYI: the state-terror hybrid
No. 7Cars and blades: why low-tech attacks remain the hardest to stop
No. 8The executive as target: protective intelligence after Thompson
No. 9Islamic State’s southern pipeline: why the Sahel is now Europe’s problem
No. 10The hoax as a weapon: this week’s aviation bomb threats
No. 11When the freezer is the target: cyber-physical convergence
No. 12The insider for hire: how criminals and states now buy their way in
