{ "slug": "insider-threat-exposure", "title": "Insider Threat Exposure Calculator", "heading": "Insider Threat Exposure Calculator", "category": "financial", "url": "https://www.revenuelab.fyi/toolbox/insider-threat-exposure", "summary": "Estimate annual expected loss from malicious and negligent insider incidents.", "description": "Insider threats split into two very different categories with different economics: malicious insiders (data theft, sabotage, fraud) are rarer but more expensive per incident, while negligent insiders (misconfigured sharing, lost devices, falling for social engineering) are far more common but usually cheaper to remediate. Ponemon Institute research on insider threat cost puts average per-incident cost around $150,000-$700,000 depending on whether it's negligent, malicious, or credential-theft-based, with total annual cost scaling by headcount since larger organizations simply have more people who can create an incident. This calculator applies separate incident rates and average costs to malicious and negligent categories based on your headcount, then layers in a reduction factor for controls you already have (DLP, privileged access management, offboarding automation, background checks) to estimate your residual annual exposure versus the unmitigated baseline.", "formula": "Exposure = headcount × [(malicious rate × malicious cost) + (negligent rate × negligent cost)] × (1 − control effectiveness %).", "dateModified": "2026-09-30", "run_url": "https://www.revenuelab.fyi/api/public/calc?tool=insider-threat-exposure", "inputs": [ { "id": "headcount", "label": "Total employees + contractors with system access", "kind": "number", "hint": null, "default": 300, "unit": null, "min": 1, "max": null }, { "id": "maliciousRate", "label": "Malicious incidents per 1,000 employees/year", "kind": "number", "hint": null, "default": 2.5, "unit": null, "min": 0, "max": 50 }, { "id": "maliciousCost", "label": "Avg cost per malicious incident", "kind": "number", "hint": null, "default": 650000, "unit": null, "min": 0, "max": null }, { "id": "negligentRate", "label": "Negligent incidents per 1,000 employees/year", "kind": "number", "hint": null, "default": 12, "unit": null, "min": 0, "max": 200 }, { "id": "negligentCost", "label": "Avg cost per negligent incident", "kind": "number", "hint": null, "default": 150000, "unit": null, "min": 0, "max": null }, { "id": "controlEffectiveness", "label": "Existing control effectiveness (DLP, PAM, offboarding)", "kind": "number", "hint": null, "default": 35, "unit": null, "min": 0, "max": 100 } ], "outputs": [ { "id": "residualExposure", "label": "Residual annual exposure (after controls)", "format": "currency", "hint": null, "primary": true }, { "id": "grossExposure", "label": "Gross exposure (no controls)", "format": "currency", "hint": null, "primary": false }, { "id": "maliciousExposure", "label": "Malicious insider share", "format": "currency", "hint": null, "primary": false }, { "id": "negligentExposure", "label": "Negligent insider share", "format": "currency", "hint": null, "primary": false }, { "id": "avoidedLoss", "label": "Loss avoided by existing controls", "format": "currency", "hint": null, "primary": false } ], "worked_example": { "inputs": [ "Total employees + contractors with system access: 300", "Malicious incidents per 1,000 employees/year: 2.5", "Avg cost per malicious incident: 650000", "Negligent incidents per 1,000 employees/year: 12", "Avg cost per negligent incident: 150000", "Existing control effectiveness (DLP, PAM, offboarding): 35" ], "outputs": [ "Residual annual exposure (after controls): $667,875", "Gross exposure (no controls): $1,027,500", "Malicious insider share: $487,500", "Negligent insider share: $540,000", "Loss avoided by existing controls: $359,625" ] }, "how_to": { "title": "How to use this", "steps": [ "Enter total employees + contractors with system access.", "Enter malicious incidents per 1,000 employees/year.", "Enter avg cost per malicious incident.", "Enter negligent incidents per 1,000 employees/year.", "Enter avg cost per negligent incident.", "Enter existing control effectiveness (dlp, pam, offboarding).", "Read your residual annual exposure (after controls) on the right — it updates as you type.", "Hit Share to keep the scenario or send it to someone." ] }, "scenarios": [ { "name": "Conservative", "description": "Lower-end numbers — what if things land soft?", "values": { "headcount": 180, "maliciousRate": 1.5, "maliciousCost": 390000, "negligentRate": 7, "negligentCost": 90000, "controlEffectiveness": 20 } }, { "name": "Typical", "description": "Defaults — the most common real-world setup.", "values": { "headcount": 300, "maliciousRate": 2.5, "maliciousCost": 650000, "negligentRate": 12, "negligentCost": 150000, "controlEffectiveness": 35 } }, { "name": "Ambitious", "description": "Higher-end numbers — what if things really pop?", "values": { "headcount": 480, "maliciousRate": 4, "maliciousCost": 1040000, "negligentRate": 19, "negligentCost": 240000, "controlEffectiveness": 55 } } ], "limitations": [ "Results are estimates before tax, fees, and inflation unless an input explicitly covers them.", "Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.", "This is educational maths, not financial advice. Check anything contractual with the lender or your accountant." ], "faq": [ { "q": "Why is malicious insider cost so much higher per incident than negligent?", "a": "Malicious insiders often have legitimate access and know exactly what's valuable and how to exfiltrate it while avoiding detection, leading to larger data volumes stolen, longer dwell time, and more complex forensic investigation and legal response. Negligent incidents (a misdirected email, an unencrypted lost laptop) are usually contained faster and involve less deliberate evasion." }, { "q": "What controls actually move the effectiveness number?", "a": "Privileged access management with just-in-time access requests, data loss prevention tooling on egress points (email, USB, cloud storage), automated and audited offboarding that revokes access same-day, and user behavior analytics that flags anomalous data access patterns are the highest-impact controls, each contributing roughly 10-20 percentage points of effectiveness when implemented well." }, { "q": "Does background checking reduce malicious insider risk?", "a": "It helps for candidates with a documented history of theft or fraud, but most malicious insider incidents involve people who had no prior red flags and became a risk after a triggering event like financial distress, a bad performance review, or a resignation, so behavioral monitoring during employment matters more than pre-hire screening alone." }, { "q": "How does offboarding speed affect exposure?", "a": "Access that isn't revoked within hours of termination is one of the most common root causes in insider incident case studies, since a departing employee (or someone using their still-active credentials) has a clear window to exfiltrate data or cause damage with intent to harm the company or benefit a new employer." } ], "related": [ "https://www.revenuelab.fyi/toolbox/annualized-loss-expectancy", "https://www.revenuelab.fyi/toolbox/vendor-risk-exposure", "https://www.revenuelab.fyi/toolbox/key-rotation-downtime-cost" ], "license": "CC-BY-4.0", "citation": "RevenueLab — Insider Threat Exposure Calculator (https://www.revenuelab.fyi/toolbox/insider-threat-exposure)" }