Cyber Myth: The Threat Is Always Outside the Building

Some of the most damaging security incidents start with someone who already has a password.

Most owners picture a stranger overseas hammering on the firewall. Those attacks are real and they never stop. The person who already has a login skips all of that. They open the door with a key you gave them, and most small business security is set up to watch for strangers.

"Insider threat" sounds like something out of a spy movie. In a 25-person shop in Deer Park, La Porte or Pasadena, it looks a lot more ordinary than that.

Six ways it shows up

1. Data walking out the door. A salesperson leaving for a competitor exports the customer list the week before giving notice. A laptop with every job file on it leaves in the back of a truck and doesn't come back.

2. Sabotage. Rare, but when it happens it's usually someone who was let go and still had access the next morning. Deleting a shared folder or changing an admin password takes about two minutes.

3. Access nobody meant to grant. The front desk can open the payroll folder because permissions were set up years ago and never reviewed. Nobody did anything wrong. The access is still there, waiting for someone to use it.

4. Mistakes. The wrong attachment to the wrong customer. Clicking the fake invoice. Copying the bid spreadsheet to a personal Dropbox to finish it at home. This is the most common of the six, and nobody involved meant any harm.

5. Shared passwords. The shop floor PC with one login taped to the monitor. The accounting password everyone in the office knows. When a shared password leaks, you can't tell who used it, and you can't shut off one person without locking out everyone else.

6. Unapproved AI tools. Someone pastes a customer contract into a free AI chatbot to clean up the wording. Depending on the tool and its settings, that text can be stored and used to train it. You won't know it happened.

What to watch for

No single one of these proves anything. A pattern does.

• Someone opening folders that have nothing to do with their job.
• Large downloads, or copies to USB drives, especially in the weeks before a resignation.
• Repeated requests for access the role doesn't need.
• Company data on personal laptops and phones.
• Antivirus or other security software turned off. On a managed machine, a security agent that stops reporting shows up on our side. On an unmanaged one, nobody notices.
• Customer or company information going into AI tools you haven't approved.
• A sudden change in behavior, like missed deadlines, secrecy or obvious stress. That's a reason for a conversation, not an accusation.

Five things that close most of the gap

1. Turn on multi-factor authentication everywhere, starting with email. Once MFA is on, a stolen or shared password by itself stops being enough to get in.

2. Give people access to what their job needs, and review it once a year. Ask one question today: who can open payroll, the customer list and the bid folder? If nobody can answer that, you've found your first problem.

3. Shut off access the day someone leaves. Email, Microsoft 365, the VPN, your line-of-business software, the door code, and every shared password they knew. Write that list down once so it gets done the same way every time.

4. Train your people and write an AI rule. One page that says which AI tools are approved and what never goes into one (customer data, financials, passwords) beats having no policy at all.

5. Back up your data and plan the response. A tested backup turns a deleted folder into an inconvenience instead of a crisis. We've written up what belongs in a response plan here: [link to incident response plan post].

Where we come in

For our managed clients, a good part of this is already running. MFA protects every administrator account and server login. Security software on every managed machine reports to us when it's switched off or tampered with. Offboarding covers every account on the list, not just email. Every month you get a written report showing what we found. MFA for every user and phishing training for your staff are available on top of that.

If you'd like to know where your business stands, book 30 minutes and we'll go through these six with you and tell you which ones you're exposed to right now.