Study: Insider-Driven Data Loss Events Cost an Average of $15 Million Per Incident

  • Mar 11, 2024

Code42 Software recently released its annual Data Exposure Report (DER) for 2024, examining the intricacies of insider threats facing organizations today. The study found that data loss from insiders poses increased threats to security, further exacerbated by the introduction of AI and generative AI (GenAI) technology.

Since 2021, there has been a 28% average increase in monthly insider-driven data exposure, loss, leak, and theft events. The majority of respondents (85%) expect this trend to continue over the next 12 months. While most companies (99%) have data protection solutions in place, 78% of cybersecurity leaders admit they’ve still had sensitive data breached, leaked, or exposed. As today’s risks are increasingly driven by AI and GenAI, the way employees work, and the proliferation of cloud applications, respondents state they need more visibility into source code sent to repositories (88%), files sent to personal cloud accounts (87%), and customer relationship management (CRM) system data downloads (90%).

“Today, data is highly portable. While AI and cloud technologies are igniting new business ventures that allow employees to connect, create, and collaborate, they also make it easier to leak critical corporate data like source code and IP,” said Joe Payne, President and CEO of Code42. “This year, the research highlights the new challenges posed by AI as data sets are being pushed outside of organizations to train LLMs. We also see that source code is now considered the most important data to protect, other than financial information and research data. This is a critical finding, as most data protection tools are incapable of spotting the most common source code exfiltration techniques."

The cybersecurity skills gap creates a black hole for IP loss and compliance

Over three-fourths surveyed (79%) believe their cybersecurity team has a shortage of skilled workers, leading cybersecurity leaders to turn to AI (83%) and GenAI (92%) technology to fill the talent gap; but these aren’t a 1:1 replacement, and the report also cautions against the possible data loss risks of these tools.

The study also found:

  • Two-thirds of cybersecurity leaders (68%) state that data regulations are unclear, while even more (73%) are not fully confident their company is complying with new data protection laws
  • The vast majority (98%) believe their data security training requires improvement, with almost half of respondents (44%) believing it requires a complete overhaul
AI and GenAI are creating unique risks to data security The vast majority (85%) of cybersecurity leaders agree that their company’s sensitive data is increasingly vulnerable to new AI technologies.

The study also found:

  • 87% are concerned their employees may inadvertently expose sensitive data to competitors by inputting it into GenAI
  • 87% are concerned their employees are not following their GenAI policy

Employee age and role are creating unique risks to data security

Risks can vary by employee age and role, with companies more concerned about data security breaches from Generation Z and Millennials falling victim to phishing attacks (61%), oversharing company information online (60%), sending company files/data to personal accounts/devices (62%), and putting sensitive data into GenAI tools (58%).

Respondents also believe senior management (81%) and board members (71%) pose the greatest risk to their company’s data security, likely due to having wide-reaching access to the most sensitive data.

Insider data loss drains time, money, and security teams

Insider-driven data exposure, loss, leak, and theft events can have vast financial repercussions, with cybersecurity leaders estimating that a single event would cost their company $15 million, on average.

The study also found:

  • Respondents spend an average of 3 hours per day investigating insider-driven data events
  • 72% of cybersecurity leaders are worried they could lose their job from an unaddressed insider breach
  • To be effective, companies believe that data protection solutions should offer speed and ease of investigation (42%), visibility into file contents and metadata (39%), and should be able to integrate with other tech solutions (38%)

Featured

  • The Next Generation

    Video security technology has reached an inflection point. With advancements in cloud infrastructure and internet bandwidth, hybrid cloud solutions can now deliver new capabilities and business opportunities for security professionals and their customers. Read Now

  • Help Your Customer Protect Themselves

    In the world of IT, insider threats are on a steep upward trajectory. The cost of these threats - including negligent and malicious employees that may steal authorized users’ credentials, rose from $8.3 million in 2018 to $16.2 million in 2023. Insider threats towards physical infrastructures often bleed into the realm of cybersecurity; for instance, consider an unauthorized user breaching a physical data center and plugging in a laptop to download and steal sensitive digital information. Read Now

  • Enhanced Situation Awareness

    Did someone break into the building? Maybe it is just an employee pulling an all-nighter. Or is it an actual perpetrator? Audio analytics, available in many AI-enabled cameras, can add context to what operators see on the screen, helping them validate assumptions. If a glass-break detection alert is received moments before seeing a person on camera, the added situational awareness makes the event more actionable. Read Now

  • Transformative Advances

    Over the past decade, machine learning has enabled transformative advances in physical security technology. We have seen some amazing progress in using machine learning algorithms to train computers to assess and improve computational processes. Although such tools are helpful for security and operations, machines are still far from being capable of thinking or acting like humans. They do, however, offer unique opportunities for teams to enhance security and productivity. Read Now

Most   Popular

Featured Cybersecurity

New Products

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3