What is AI insider risk?

AI insider risk is the exposure created when the people inside an organization move real work, and real data, through AI tools that sit outside the company's visibility and control. It covers what employees paste into chatbots, the personal AI accounts they sign in with, and the agents they let act on their behalf. Most of it is ordinary and non-malicious, which is exactly why it is easy to miss.

The plain definition

AI insider risk is the exposure that comes from your own people using AI to do their jobs. It is the sensitive document dropped into a chatbot to get a summary, the customer list pasted into a personal account to draft an email, the code shared with an assistant to find a bug, and the agent granted standing access to a mailbox or a drive. The work is legitimate. The exposure is a side effect of where the data goes and who can see it once it leaves the person's screen.

The word insider matters. This is not an outside attacker breaking in. It is a trusted employee, contractor, or partner acting inside their normal access, using tools that promise to make them faster. The risk is not that they intend harm. It is that a copy of something sensitive now lives in a place your controls never accounted for, tied to an account you may not own, feeding a model you cannot audit.

AI did not invent insider risk. It changed its shape and its volume. When most knowledge work starts flowing through a prompt, the surface where sensitive data can leak stops being the file server and becomes the text box.

How the shape changed

Classic insider threat had a recognizable silhouette. An employee gave notice, then copied a folder to a USB drive or forwarded a batch of files to a personal inbox in the last two weeks before leaving. The event was discrete, the timing was suspicious, and the tooling built to catch it watched for exactly that: bulk movement, unusual downloads, a departing name on a watchlist. It worked because the behavior was rare and looked different from normal work.

The AI-era version looks nothing like that. There is no departure and no bulk copy. There is a marketing manager pasting an unreleased roadmap into a chatbot to tighten the wording, a support agent dropping a ticket full of customer detail into an assistant to draft a reply, an analyst signing in with a personal account because it is the one they already pay for. Microsoft and LinkedIn's 2024 Work Trend Index found that 78% of people using AI at work bring their own tools, which means much of this activity happens on accounts the company never provisioned and cannot see. Verizon's 2026 Data Breach Investigations Report found that 67% of employees who use AI on corporate devices sign in with a personal account, so even work done on managed hardware often runs through personal identity.

Agents push the shape further still. An employee can now delegate a task to something that reads, decides, and acts across systems on their behalf. The insider is no longer only a person moving a file once. It is a person plus the software they authorized, operating continuously, at machine speed, inside their access.

Why it is mostly ordinary, not malicious

The instinct with anything labeled insider risk is to picture a bad actor. That instinct is mostly wrong here. The dominant story of AI insider risk is a diligent employee trying to move faster with the best tool available, who has no idea a copy of something sensitive just crossed a boundary. There was no policy in front of them at the moment of the paste, and often no policy that even named the tool.

This tracks with what breach data has said for years. Verizon's 2025 DBIR found that about 60% of breaches involve a human element, and the great majority of that is error and ordinary behavior rather than sabotage. Gartner reported in 2025 that 69% of organizations have evidence or suspect their employees are using public generative AI at work, which describes a normal, widespread habit, not a fringe of insiders acting in bad faith.

Framing the problem as malice leads to the wrong response, which is surveillance and suspicion aimed at the workforce. Framing it as ordinary behavior leads to the right one, which is visibility into where AI touches sensitive data and guardrails that meet people in the flow of work. The cost of getting this wrong is not small. Ponemon's 2026 Cost of Insider Risks Global Report put the average annual cost of insider risk at 19.5 million dollars, and it found that 53% of insider incidents stem from negligence rather than malice.

Why endpoint and DLP tooling miss it

Most of the security stack was built to watch files and networks. Endpoint agents track what runs on a device. Data loss prevention inspects files leaving over known channels, matching patterns and blocking transfers. Both assume the risky thing is a recognizable object moving along a monitored path. AI insider risk breaks that assumption. The risky thing is often a person's judgment expressed as a sentence typed into a browser tab.

A prompt is not a file. When an employee retypes a figure from a confidential report into a chatbot, or paraphrases a customer's situation, no file moved and no signature matched. When they use a personal account, the traffic may never touch a channel the DLP tool inspects. When they authorize an agent, the action happens through an API grant that looks like sanctioned access, not exfiltration. The exposure lives in the person and the prompt, which is precisely the layer these tools were never designed to see.

This is the gap that makes AI insider risk feel invisible. Organizations report clean DLP dashboards while sensitive material flows through AI every day, because the dashboards are watching the wrong surface. Seeing it requires instrumenting the AI usage itself, at the point where a human and a model meet, not just the disk and the wire. This is the problem that modern insider risk management sets out to solve.

The five signals

Because the risk is diffuse, a single control does not capture it. The AI Insider Risk Index measures it across five signals, each answering a question the classic stack leaves open. AI visibility asks whether you can see which AI tools your people use and what they put into them. Data movement asks whether sensitive content is crossing into those tools and where it lands. Identity and ownership asks whether AI activity runs on accounts the company controls or on personal ones it cannot govern.

The remaining two close the loop after something happens. Evidence and audit asks whether you could reconstruct what an employee or an agent did with AI if you had to, weeks later, for a regulator or an investigation. Remediation reach asks whether you can actually act, revoking access, pulling data back, or correcting behavior, once you find a problem. Together the five turn a vague worry into something with structure, weighted so the signals that expose the most risk count for the most.

The assessment on this site scores an organization across these five signals and places it in one of five exposure bands, from Contained through to Critical. It takes about ten minutes and produces a picture of where AI is touching your data today, not a hypothetical.

Why measuring it before an incident matters

The reason to measure now is that AI insider risk is accumulating whether or not anyone is watching. Every day of ordinary use adds more copies of sensitive data in more places, on more accounts you do not own. The exposure does not announce itself. It surfaces as an incident, and by then the question shifts from prevention to explanation, which is far harder and far more expensive.

Measuring first changes the posture from reactive to informed. A score across the five signals tells you which gap is widest, whether it is invisible personal accounts, ungoverned data movement, or the absence of any audit trail, so effort goes where the exposure actually is instead of where it is easiest to imagine. It also gives security leaders a baseline they can defend and revisit, rather than a one-time cleanup that drifts the moment attention moves on.

AI insider risk is now a standing condition of doing business, not an event. Treating it that way, with a clear measure taken before the incident forces the issue, is the difference between managing a known exposure and discovering an unknown one the hard way. You can take the assessment on this site and see where you stand today.

Common questions