CISA Insider Threat Mitigation Guide 2026: building a program to detect, assess, manage

In two minutes

• The guide helps critical infrastructure owners and operators of any size set up or improve an insider threat mitigation program, and it treats violence, espionage, sabotage, theft and cyber harm as one problem (pp. 5, 14).
• It defines an insider as anyone with current or past authorized access or knowledge, and an insider threat as the potential to use that access to harm the organization through malicious, negligent or unintentional acts (p. 11).
• It says most recent insider threats are unintentional or negligent, and that these are on average less costly than malicious ones (p. 12).
• It describes a six-stage path toward an incident: grievance and ideation, preparation, exploration, experimentation, execution, escape. It says organizations should not wait for several stages before intervening (pp. 17-19).
• The operating model is detect and identify, assess, manage. The guide calls a multidisciplinary threat management team "the single most important feature" of an effective program (pp. 28, 46).
• The planning advice covers executive sponsorship, a single Senior Official (a CISO is named as a natural fit), a governance group, legal counsel, a critical asset inventory, and an AI section on data poisoning, model tampering and unapproved AI tools (pp. 31-32, 37-38).
• It stresses culture: confidential reporting, protection over punishment, no zero-tolerance policies, and open notice to staff about monitoring (pp. 33, 35, 41, 43, 50-51).
• The text supplied here runs to p. 52 of 113. Detection indicators, assessment, management, and the conclusion and appendices (chapters 4 to 7) are listed in the contents but are not covered in this digest.

Key numbers

• $16.2 million (2023) to $17.4 million (2024): Estimated annualized cost of insider threat incidents (p. 6, Figure 1).
• $8.8 million: Annualized cost per organization attributed to insider negligence (p. 6, Figure 1).
• $4.8 million: Annualized cost per organization for credential theft (p. 6, Figure 1).
• 81 days: Average time to contain an insider threat incident (p. 6, Figure 1).
• 57%: Medium and large North American companies that experience 21+ incidents per year (p. 6, Figure 1).
• 60% in 2019 to 74% in 2024: Cybersecurity professionals concerned about malicious insider attacks (p. 22).
• 29%: Surveyed professionals who feel adequately equipped to protect against insider threats (p. 22).
• 64% (DLP), 60% (PAM), 57% (UEBA), 53% (SIEM), 50% (EDR): Share of companies using each technology to reduce the cost of insider threat, per a 2022 Ponemon report (p. 43, Figure 10).

What to do with it

• Appoint a single Senior Official with direct access to executives. The guide names a CSO or CISO as a natural fit (p. 31).
• Form a governance group from security, HR, IT, legal, privacy, behavioral health and other functions, and give it authority over budget, policy and the incident response plan (p. 32).
• Build a critical asset register listing asset type, risk level, location, primary use and who has access, using NIST and ISO risk standards (p. 38).
• Write an Insider Threat Incident Response Plan covering unintentional and intentional incidents, and set up confidential reporting pathways, with legal counsel and law enforcement input (pp. 40-41).
• Add AI measures: train staff on AI use, classify sensitive data, secure existing AI tools, and update user agreements (p. 37).
• Stand up a threat management team with training and tabletop exercises, and use risk rubrics as an aid rather than a substitute for analyst judgment (pp. 44, 48-49).

Read the full document if

• you are starting an insider threat program and want a staged plan with named roles, governance and policy questions.
• you need a framework that joins HR, legal, physical security and cybersecurity around insider risk, including workplace violence.
• you want the legal, privacy and culture cautions on monitoring and reporting before you deploy user activity monitoring tools.

What it relies on

CISA presents the guide as options for consideration, not as requirements under any law or regulation (p. 4). It rests largely on cited sources: the National Insider Threat Task Force guidelines, FBI work on targeted attacks, Carnegie Mellon SEI research on positive incentives, NIST SP 800-37, and CISA's own earlier guides. Its cost and survey figures come from third parties such as Ponemon, Securonix, BLS and SHRM, and some are from 2018 to 2022. Figure 1 itself says annual losses are hard to quantify because of underreporting (p. 6). It includes two case studies (pp. 20, 24). CISA is an agency and does not endorse commercial products (p. 4). CISA offers reporting and investigative forms that the guide recommends (p. 40).

Our read

A program-building reference for security leaders who must work with HR, legal and facilities. It is useful for the governance model, the Senior Official and threat management team roles, the policy questions, and the notes on privacy and reporting culture. Its cost figures come from older third-party sources. Only chapters 1 to 3 (to p. 52) were digested here.