2023 Insider Risk Investigations Report ~ The Rise of Employee Attrition and Data Exfiltration

Today we released our 2023 Insider Risk Investigations Report. Our report, released annually since 2017, is driven by one key goal: To empower organizations to better understand and mitigate insider risk, so they can safeguard sensitive data and workforce privacy effectively.

Every day, our Insider Intelligence and Investigations (i3) Team works closely with DTEX customers to detect and respond to potential insider risk incidents before a breach occurs.

The findings contained within this report draw on real-world data observed as part of hundreds of insider incidents and assessments conducted on our customers and prospects around the world.

In 2022, our i3 Team identified a direct correlation between employee attrition and data loss events. Where voluntary turnover coincided with a spike in IP and customer data theft from departing employees, cases of involuntary turnover corresponded with higher rates of system sabotage.

In several investigations, there was a clear lack of delineation of what constitutes as acceptable use on corporate versus personal devices and accounts. In many cases, this lack of boundaries was the mechanism through which data loss occurred.

Notable statistics from our report include:

• During the first half of 2022, there was a 20% increase in voluntary turnover compared with pre-pandemic levels. This coincided with a 35% increase in data theft incidents caused by employees leaving companies
• 12% of employees took sensitive IP with them when they left an organization, including customer data, employee data, health records, sales contracts, and more
• 75% of investigation requests were managed by human resources in the second half of 2022
• Unsanctioned 3rd-party work on corporate devices increased nearly 200%
• Unsanctioned application usage increased by 55%.

Our findings provide some key take-home messages for executive leaders and insider risk practitioners across cybersecurity, risk and human resources.

Most importantly, our report demonstrates the growing need to put the human at the center of a cyber strategy, starting with an insider risk management program.

In practice, this means fostering a workforce culture of trust and transparency, backed by clear and considered communication, policies and supporting data-driven technology.

Our 2023 Insider Risk Report also features some practical tools for insider risk professionals to use as part of their day-to-day. This includes six unique indicators that serve as early warning signs of insider risk, and strategic frameworks for decision-making and communication based on insider risk proportionality.

For the complete findings, takeaways and access to the above tools, we invite you to download our 2023 Insider Risk Investigations Report.