CISA Updates Insider Threat Guidance With New Advice on Remote Work and AI

CISA has published an updated version of its insider threat mitigation guide, incorporating new advice on managing insider risk in remote and hybrid work environments, understanding the implications of AI tools in the workplace, and improving detection of insider threat indicators. Infosecurity Magazine reports that the updated guidance reflects the operational reality that many organisations now face, where employees work from multiple locations, use personal devices, and increasingly rely on AI-powered tools that may introduce new data handling and exfiltration risks. The guide emphasises the importance of clear policies, user behaviour monitoring, access controls, and creating a culture where employees understand the risks and feel able to report concerns without fear of disproportionate consequences.

Why this matters for UK organisations

For UK businesses, insider threat remains one of the most difficult risks to manage because it involves trusted individuals with legitimate access to systems and data. The shift to remote and hybrid work has expanded the attack surface, making it harder to monitor user behaviour, detect anomalies, or enforce physical security controls. The increasing use of AI tools, including large language models and automated data processing platforms, introduces new pathways for accidental or deliberate data leakage. Employees may use AI tools to process sensitive information without understanding the data handling implications, or malicious insiders may exploit these tools to exfiltrate data in ways that are harder to detect. Insider threats can take many forms, from deliberate sabotage or data theft by disgruntled employees to accidental data leakage by well-meaning staff who do not understand the risks. The updated CISA guidance provides a structured framework for organisations to review their insider threat programmes, clarify accountability, and ensure that technical controls, policies and cultural factors are all working together. It also highlights the importance of balancing security monitoring with employee privacy and trust, ensuring that insider threat programmes are proportionate, transparent and focused on genuine risk rather than creating a culture of suspicion.

What to review

UK organisations should review whether their insider threat programme adequately addresses remote work, the use of AI tools, and the detection of unusual user behaviour. Consider whether your policies clearly explain acceptable use of AI platforms, whether your monitoring tools can detect data exfiltration through cloud services, and whether there is clear ownership for investigating and responding to insider threat indicators across HR, IT and security teams. Review whether your data loss prevention controls cover modern exfiltration methods, including uploads to AI platforms, file sharing services and personal cloud storage. Consider whether your user behaviour analytics tools can detect anomalies in remote work environments, where employees may access systems from multiple locations and devices. Clarify who is responsible for reviewing insider threat alerts, how investigations are conducted in a way that respects employee privacy, and how you balance the need for monitoring with maintaining trust and transparency. Ensure that your insider threat programme includes clear escalation paths, defined thresholds for investigation, and processes for involving HR, legal and senior management when appropriate. Consider whether your training and awareness programmes help employees understand insider threat risks, including the risks of using AI tools to process sensitive data, and whether employees feel able to report concerns or mistakes without fear of disproportionate consequences.

Source: Infosecurity Magazine