CISA Updates Insider Threat Guide With New Mitigation Advice

The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Insider Threat Mitigation Guide with new case studies, statistics and guidance on hybrid and remote work, artificial intelligence and adverse employee separations.

The agency published the revision on September 9. First issued in 2020, the guide supports security and human resources professionals who run insider threat programs, along with leaders at any level, and CISA said any organization can use it regardless of the maturity of its security.

The agency added that the update acknowledges the growing impact of insider threats on critical infrastructure and adds use cases for what it called a dynamic and evolving operational landscape.

New Guidance Addresses Changing Workplace Risks

CISA also said the guide arrives in a more streamlined format, with sections consolidated. It expands on emerging workplace trends, chiefly the rise in hybrid work and remote work, and how each changes an organization's control over physical and digital access.

On artificial intelligence, the agency said the new material covers AI used to manipulate or deceive. CISA also added content on access control, visitor screening and mitigating the risk of adverse employee separations.

The guide is intended to give employees an understanding of behavioral indicators that may signal a risk. It also points to newly released CISA resources supporting preparedness and early risk detection, which the agency framed as the practical route into the material for organizations without an existing program.

Read more on insider threat risks: AI-Driven Insider Risk Now a "Critical Business Threat," Report Warns

"Insider threats continue to evolve as technology becomes more advanced," said Scott Breor, CISA's acting executive assistant director for infrastructure security. He urged organizations to build a program that "protects key assets, prevent violence, reduce losses, safeguard sensitive data, and save lives."

The Guide Covers Violence as Well as Data

CISA's framing is broader than data loss. Breor's list runs from protecting assets to preventing violence and saving lives, and the guide sits in the agency's physical security section alongside new material on access control and visitor screening.

Breor said industry and government partner feedback informed the update, and encouraged organizations to review the guide and assess their own programs against it. CISA gave no timetable for further revisions.

The revision lands amid rising concern about employees and AI tools, and the new material on AI covers its use to manipulate or deceive rather than any broader assessment of the technology's role in insider incidents.