Most of the security conversation - phishing, ransomware, firewalls - is about keeping outsiders out. Insider risk is a different, quieter category: incidents that involve someone who already has legitimate access. It's uncomfortable to think about, which is exactly why it often goes unaddressed.
Two very different kinds of insider risk
Malicious
A staff member deliberately taking data before resigning - a client list, pricing sheets, or proprietary documents copied to a personal drive in the days before they hand in notice. Rarer than the accidental category, but the one businesses picture first when they hear “insider threat.”
Negligent or accidental
Far more common. A staff member emails a spreadsheet of client data to their personal account to work on it at home. A SharePoint link gets shared as “anyone with the link” instead of restricted to specific people. A staff member falls for a phishing email and, believing they're following IT's instructions, hands over credentials or approves a fraudulent payment. None of these involve malicious intent, but all of them can result in genuine data exposure.
Why this gets underestimated
“We trust our people” is a completely reasonable thing for a business owner to feel - and it's also beside the point. Insider risk isn't really about whether staff are trustworthy. It's about whether access is scoped to what people actually need, whether unusual activity would be noticed, and whether access is removed promptly when someone leaves. A trustworthy team with excessive standing access and no audit trail is still exposed - not because anyone intends harm, but because a single compromised account or a moment of carelessness has nothing standing in its way.
Common scenarios we see in Perth businesses
- Departing sales staff and client data - a resigning account manager downloads a client and pricing list before their last day, with no alert triggered because mass exports aren't monitored
- Bookkeepers with unchecked financial access - a single person able to create, approve, and pay invoices with no second approval step, and no audit trail if something goes wrong
- Slow or incomplete offboarding - a departing staff member or contractor's VPN or system access remains active days or weeks after they've left, because nobody had a complete list of what they had access to
- Shadow copies of business data - files emailed to personal accounts or saved to personal cloud storage “to work from home,” creating a copy of sensitive data completely outside the business's control
Practical controls - not surveillance
The right response isn't monitoring every keystroke. It's a handful of access hygiene practices that catch the genuine risks without treating staff as suspects:
- Least-privilege access - staff have access to what their role requires, not blanket access to every file share and system by default
- Basic data loss prevention (DLP) - Microsoft 365 can alert on mass downloads, external sharing of sensitive data, or emails to personal domains containing client or financial data, and it's usually switched off by default rather than actually configured
- Consistent offboarding - access revoked the same day notice is given for sensitive systems, following a documented checklist rather than relying on memory - see our Microsoft 365 offboarding checklist
- Audit logging enabled - on Microsoft 365, financial systems, and CRMs, so unusual activity can actually be investigated after the fact rather than discovered by accident
- Separation of duties on financial systems - no single person able to both create and approve a payment without a second check
- A clear, published data policy - staff should know upfront that business data stays on business systems; a transparent policy sets expectations rather than functioning as a surprise “gotcha” after the fact
The balance point
The overwhelming majority of staff will never trigger any of these controls, because they're simply doing their job. That's exactly why this is worth setting up properly - a small number of access hygiene measures, configured once, quietly protect the business without adding friction to normal work or creating a culture of suspicion.
Frequently Asked Questions
Isn't insider threat just about not trusting your staff?
No - and treating it that way misses the point. Most insider incidents aren't malicious; they're a departing employee taking data they mistakenly think is theirs, a well-meaning staff member emailing files to a personal account to work from home, or a legitimate account being used by an attacker after a phishing compromise. It's an access hygiene issue, not a trust issue.
What's the single biggest gap we see in Perth businesses?
Offboarding that isn't applied consistently. Access to email, file shares, CRMs, and financial systems often isn't revoked until days after someone leaves - or is never fully revoked because nobody has a complete list of what a departing staff member had access to in the first place.
Do we need to monitor everything our staff do?
No, and doing so is usually counterproductive. The goal is basic audit logging so unusual activity - a mass export of client data, an unusual login, access to files outside someone's normal role - can be detected and investigated, not blanket surveillance of day-to-day work.
How does this relate to Microsoft 365 specifically?
Microsoft 365 has audit logging and basic data loss prevention (DLP) capabilities built in, but usually turned off by default. Enabling audit logs, alerting on mass downloads or external sharing of sensitive data, and applying least-privilege access to SharePoint and Teams sites are the highest-value, lowest-effort steps for most Perth businesses.
Not sure who has access to what in your business?
We help Perth businesses review access, set up audit logging, and build an offboarding process that's actually followed - practical controls, not surveillance.
Talk to us about access and offboarding →For related reading, see our guides to Employee Offboarding Checklist for Microsoft 365 and Conditional Access Policy Explained.