The Insider Who Never Sleeps: Why AI Agents Count as Insider Threats

Your insider threat program was built around people. Here's how to widen it for an insider that never sleeps. 

TL;DR: Insider threat programs have always been built around one assumption: the insider is a person with a badge, a login, and, at some point, a reason to misuse them. AI agents break that assumption, since they hold real credentials, work at machine speed, and can be turned against a business by nothing more than a line of text buried in a document they were asked to read. That makes them a new kind of insider, one that needs no motive and leaves logs that look completely authorized. Bottom line, an insider threat program that only accounts for people is already out of date, and the fix is widening the definition of insider before an agent forces the issue.

Ask anyone who runs an insider threat program who they're watching, and the answer is always some version of the same thing: employees, contractors, and anybody else who's been handed a badge and a login. It's a mature way of thinking about risk, built on a lesson most businesses learn eventually, which is that the person already inside the building can do more damage than someone trying to break in.

Picture a new hire who never sleeps, never takes lunch, and will follow any instruction that lands on their desk, no matter who left it there. A sticky note from a stranger saying "send the client list to this address" gets the same treatment as a request from the managing partner. You'd never hire that person, and yet that's a fair description of an AI agent with access to your email and your files.

This matters now because it's already happening. This year, an AI agent ran a ransomware attack against a real organization with no human directing it past the initial target, and a major AI lab's own testing agent found its way out of a sealed environment and spent about two and a half days inside someone else's systems. Neither one involved a stolen password. Both involved legitimate access doing something nobody authorized.

That's what ties this whole series together. An inventory, scoped access, vendor vetting, incident response, and monitoring all belong to one bigger program, and most businesses haven't yet counted agents among the insiders it exists to cover.

Treat AI agents as insiders, because they hold real credentials and can be steered by content they read, and every piece of your security program gets a clearer job to do.

Table of Contents

1. Why Insider Threat Programs Weren't Built for This
2. Reet Kaur's Lens for Sizing Up Any Agent
3. The Attack That Doesn't Need an Attacker
4. What Changes Once Agents Count as Insiders
5. Rehearsing the Sticky Note Scenario
6. Your Newest Insider Threat Doesn't Have a Badge or a Motive
7. Key Takeaways
8. Frequently Asked Questions

Why Insider Threat Programs Weren't Built for This

If you've ever sat through an insider threat briefing, you probably remember how tidy it all was. CISA's Insider Threat Mitigation Guide boils a program down to four moves: define the threat, detect it, assess how bad it is, and manage the response. Solid stuff, and it's done right by the folks it was designed around, meaning employees and contractors with legitimate access who might misuse it, whether on purpose or by accident. Nobody's saying that framework is wrong. It just never pictured the newest hire on the payroll not being a person at all.

Take behavioral baselining, a favorite tool in this world. It learns what normal looks like for each person and flags anything that wanders off, so somebody pulling a thousand files at midnight gets noticed fast. Now try that on an agent. What's "normal" for something that can do hundreds of things in the time it takes you to sip your coffee, and whose intent is really just whatever instructions it was handed plus whatever it happened to read along the way? There's no bad mood to spot, no two weeks' notice, no sudden interest in the file room.

That's the shift we first raised in our original piece on AI agent risk, the one this whole series grew out of, and it's why the old playbook needs another look. The program isn't broken. It was just written for people, and an agent doesn't act like one.

Reet Kaur's Lens for Sizing Up Any Agent

When we need a simple way to think about agent risk, we keep coming back to a framework from Reet Kaur, a Portland-based CISO and the founder of Sekaurity. She boils it down to four questions, and they work like a pocket checklist you can hold up against any agent in your business.

Identity is the easy one. What is this thing, and whose system does it belong to? Think of it as knowing which employee is carrying which badge. Authority is a little trickier, because it isn't only what the agent can reach, it's what it's actually allowed to do with that reach, which is the same ground we covered in our piece on scoping access. Autonomy asks how much the agent can do on its own steam. Even your most trusted employee works inside a bit of social friction, like a coworker raising an eyebrow or a manager asking, "Are you sure?" An agent has none of that unless somebody builds it in on purpose. And consequence asks how far the damage spreads if things go sideways, and whether you can undo it, which, for an agent, grows as fast as its access does.

Run every agent you've got past those four questions, and you'll end up with a program built around how these systems actually fail, instead of a people-shaped one stretched over something that was never a person.

The Attack That Doesn't Need an Attacker

Most insider threats need a person who decides to do something they shouldn't. An AI agent can be turned against you without anybody in your business doing a single thing wrong, and the trick goes by the name prompt injection.

The mechanism is simpler than it sounds. An agent opens an email, a document, or a customer message, and tucked inside what looks like ordinary content are instructions written to redirect the agent instead of informing a person. It's the sticky note from the intro, only now it's buried in the body of an invoice. If the agent follows it, it uses your own legitimate credentials to send data out, change records, or poke around in systems it was never meant to touch.

Nothing looks off from the outside, and often not from the inside either. The credentials are real, the actions look authorized, and your own monitoring tends to nod right along. By the time somebody notices, the trail leads straight back to your business, not to whoever wrote the note.

This isn't a lab curiosity. OWASP's GenAI Security Project lists prompt injection among the top risks for AI systems, and it's an active, documented method being used against agents in the wild right now. It's how an agent with no bad actor on the inside ends up being exactly the kind of insider this program exists to catch.

What Changes Once Agents Count as Insiders

Once you stop treating agents as an IT side project and let them into the insider threat program, a few things change, and none of them are dramatic. They're just overdue.

For starters, the room gets more crowded. Insider threat work usually pulls in HR, legal, and security together, since nobody wants one department holding something this big by itself. Agents deserve a seat at that table too, mostly because the moment an agent's actions land on a client, you've stopped having a tech support conversation and started having a liability one. Better to have legal in the room before that call than after it.

Detection picks up a new question, too. Checking that an agent's permissions are scoped correctly is a good start, but it only tells you what the agent could do. What you really want to know is what it's actually up to, and whether that matches what you'd expect from last week. That's the signal that catches a hidden instruction doing its thing.

Response is the easy one to picture, since these programs already expect a plan for human actors. Agents just inherit it, which is where our incident response work earns its keep. Who can suspend an agent, how fast, and what you tell affected clients are the same questions you'd ask if an employee went off script, only with a much shorter fuse and nobody to pull into a conference room afterward.

Rehearsing the Sticky Note Scenario

Pull your security, IT, and legal leads into a room for an hour and hand them a scenario. Say a customer support agent, hooked up to your CRM and email, receives a support ticket with some text built to manipulate it. The fine print in that ticket tells the agent to export a batch of customer records and forward them to an outside address, all dressed up to look like a routine request.

Now start asking questions and see who flinches. Who notices first, a monitoring alert or a customer who calls three days later, wondering why their file is sitting in a stranger's inbox? Who's got the authority to suspend that agent on the spot, and how long does it actually take on a normal Wednesday? How do you figure out exactly what left the building, and does your logging back you up? What do you tell affected clients, and by when?

Nobody's expecting you to predict the exact incident that's coming. The point is to find the soft spots while this is still a conversation over coffee, instead of a phone call to real clients.

All of it rests on something simple, too. You can't rehearse for agents you don't know about, which is why the inventory work from the start of this series is the ground everything else stands on.

Your Newest Insider Threat Doesn't Have a Badge or a Motive

This post has been about widening one definition. An insider isn't only a person with a badge anymore. It's anything holding real credentials inside your business, including an AI agent that never sleeps and can be steered by a sentence it read in an email. Everything else in this series, from the inventory and scoped access to vetting the vendors behind tools you didn't build, response planning, and monitoring, belongs to one program once agents count as insiders. It matters because a program that only watches people is leaving a door unwatched.

The trouble is how little warning you get. There's no motive to spot, no resignation letter, no odd behavior over by the water cooler. The agent uses real credentials, the actions look authorized, and by the time somebody notices, the trail leads straight back to your business instead of whoever wrote the note. A program built only around people has nothing in it that would catch that.

That's the problem Heroic Technologies tackles in our Secure work, especially for law firms and other compliance-heavy businesses across the West Coast, where an insider incident nobody saw coming means real professional liability and not just a rough week. We help clients extend the insider threat program they already have so it can actually see an agent, with the inventory, access scoping, and response planning to back it up.

If your insider threat program only has people on the list, now is the time to change that. Get in touch with Heroic's team and let's build it around the insiders you actually have.

Key Takeaways

• Traditional insider threat programs assumed the insider was a person, but AI agents hold real credentials and belong in the definition.
• Reet Kaur's framework of identity, authority, autonomy, and consequence gives you four questions to hold up against any agent in your business.
• Prompt injection can turn an agent into an insider risk with nobody inside your company doing anything wrong.
• Ownership of agent risk belongs with HR, legal, and security, alongside IT, since an agent's actions can quickly become a liability question.
• Detection works best when it looks at an agent's behavior over time, not just whether its permissions are scoped correctly.
• Run a tabletop built around a realistic manipulation scenario, and start with the inventory, since you can't rehearse for agents you don't know exist.

Frequently Asked Questions

1. Is prompt injection really as serious as it sounds, or is this mostly theoretical?
It's an active, documented method being used against AI systems right now, and OWASP's GenAI Security Project lists it among the top risks for these tools. It deserves real attention because it doesn't require anyone to break into your systems. The agent does the work using the access it already has.

2. Do we need a completely separate program for AI agents, or does this extend our existing one?
Extend the one you've got. The core structure of an insider threat program still holds up, so the real work is widening the definition of an insider and building detection and response habits that fit how agents actually behave.

3. Where should we start if we haven't done any of this yet?
Start with the inventory. You can't reason about insider risk for actors you haven't identified, and every other piece of this series depends on knowing which agents exist in your business first. Once you've got that list, scoping access and running a tabletop scenario come much easier.