Latest insider risks report spotlights employee negligence and shadow AI
26/02/2026 | Help Net Security
New research conducted by the Ponemon Institute for DTEX, based on interviews with 8750 IT and security practitioners from 354 global organisations, reveals that the average annual cost of insider risks reached £14.5 million ($19.5 million) in 2025. This represents a 20% increase over two years. However, even with rising costs, the average time taken to contain an incident fell to a record low of 67 days, down from 86 days in 2023.
Employee negligence remains the primary driver, accounting for £7.66 million ($10.3 million) in annual costs, representing 17% year-on-year growth. On average, organisations experienced 25 insider incidents during the year. The report highlights that faster containment significantly reduces the financial impact. Incidents resolved in under 30 days incur approximately £10.56 million ($14.2 million) annually, compared with £16.29 million ($21.9 million) for those lasting over 90 days.
Despite 63% of organisations now operating dedicated insider risk programmes that prevent an average of £6.10 million ($8.2 million) in breach-related costs, governance is failing to keep pace with the rise of artificial intelligence (AI). The report found that while 92% of companies acknowledge that generative AI has fundamentally altered how data is accessed, only 13% have formally integrated the technology into their business strategies. In addition, 73% of organisations expressed concern that unauthorised AI use creates invisible paths for data exfiltration. AI agents also represent a significant blind spot, as 44% of respondents believe malicious AI agents increase data theft risks, and only 19% currently classify these autonomous systems as equivalent to human insiders.
Training Announcement: Freevacy offers a range of short one-day courses on a range of data-related subjects, including data protection topics such as conducting DPIAs and privacy-by-design, as well as how to use AI tools responsibly, cybersecurity best practices, and information access. The interactive sessions cover basic concepts through to advanced examinations of specific areas. Find out more.
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 6,250 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.