Are employees to blame for rise in insider access threats? This new study claims so
Every day, someone is selling access on the dark web, and hackers are buying.
A new study by cybersecurity firm Flashpoint claims that employees are increasingly becoming the weakest link in insider threat threats. Between July 2025 and July 2026, the firm identified an average of 34 unique insider threat posts on the dark web each day, totaling 12,653 posts in the two-month period. Of these, 75% were from insiders advertising their services to sell access to their employers' IT infrastructure.
The report warns that as perimeter security and endpoint detection and response (EDR) coverage improve, threat actors are increasingly turning to the human element, buying or bribing employees for access. The largest targets were organizations in telecommunications, retail, and finance, but July 2026 saw a shift with more than half of posts affecting other industries.
Flashpoint urges organizations to monitor illicit marketplaces and recruitment efforts to detect and mitigate these threats, as insider threats are becoming increasingly difficult to detect using traditional internal security controls.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
