Labor & Employment Law Daily Wrap Up, INDUSTRY NEWS, TRENDS—Updated cybersecurity guide addresses insider threats, evolving workplace risks, (Sep 15, 2026)

By Patricia K. Ruiz, J.D.

The guidance addresses emerging risks and outlines best practices for detecting, assessing, and managing insider threats.

The Cybersecurity and Infrastructure Security Agency (CISA) released an updated Insider Threat Mitigation Guide that expands recommendations for organizations seeking to prevent, detect, assess, and manage insider threats across physical and cyber environments. The revised guide updates CISA's 2020 publication with new case studies, statistics, and guidance addressing artificial intelligence (AI), remote and hybrid work, workplace violence, visitor screening, and employee separations. CISA said the resource is intended to help organizations of any size establish or strengthen insider threat mitigation programs and protect critical assets before incidents occur.

Insider threats. The guide defines an insider as anyone with authorized access to or knowledge of an organization's personnel, facilities, information, systems, or equipment. It defines an insider threat as the potential for an individual to misuse that access through malicious, negligent, or unintentional acts that harm organizational operations, data, personnel, facilities, or networks. The guide states that insider threats can include workplace violence, sabotage, espionage, fraud, intellectual property theft, and cyber incidents.

CISA said organizations should tailor mitigation programs to their missions, cultures, critical assets, and risk profiles rather than rely on a one-size-fits-all approach. The guide recommends a framework centered on detecting and identifying threats, assessing risk, and managing threats before harmful conduct occurs.

Prevention-focused approach. According to the guide, effective programs should use multidisciplinary teams that include representatives from security, information technology, human resources, legal, risk management, and behavioral health functions. The agency also emphasizes creating a culture that encourages reporting and prevention rather than treating insider threat programs solely as enforcement mechanisms.

The guide advises organizations to balance efforts to protect assets with privacy, civil rights, civil liberties, and confidentiality considerations. It further recommends establishing reporting pathways, threat assessment processes, training programs, incident response plans, and ongoing program evaluations.

New AI guidance. Among the most significant additions is a new section addressing AI-related risks. The guide warns that insiders with privileged access may compromise AI systems through activities such as data poisoning and model tampering or expose sensitive information by entering it into unauthorized AI platforms. It also notes that external threat actors may use AI-generated phishing campaigns and deepfake content to manipulate or deceive employees.

The updated guide also expands discussion of hybrid and remote work. CISA highlights risks involving document security, organizational equipment, home-network security, and storage of digital information outside traditional office environments. The guidance recommends updating policies, procedures, and employee training to address those risks while maintaining workforce flexibility.

In announcing the update, Scott Breor, acting executive assistant director for infrastructure security, said organizations should establish mitigation programs that protect key assets, prevent violence, reduce losses, safeguard sensitive data, and save lives. He said the revisions were informed by feedback from industry and government partners and are intended to help organizations strengthen threat mitigation efforts.

Financial and human impact. The guide cites research estimating that the average annualized cost of insider threat incidents increased from $16.2 million in 2023 to $17.4 million in 2024. It also notes that insider incidents can result in physical damage, operational disruptions, intellectual property theft, sensitive data exposure, and reputational harm.

CISA also points to workplace violence risks, citing data showing approximately 25,000 nonfatal workplace violence incidents annually in the United States and an average of one workplace homicide each day. The guide states that insider threat programs can help organizations identify concerning behaviors and intervene before incidents escalate into violence, theft, sabotage, or other harmful acts.

News: AINews Privacy AgencyNews Reports ComputerFraudPrivacy Safety IndustryNewsTrends