When a data breach occurs, the company needs to quickly deal with the direct costs related to investigating the incident, containing the threat, and recovering the affected systems, something that impacts all areas of the organization.

Insider threat is the risk posed by individuals who have legitimate access to systems and who, through action or inaction, may cause harm to information security.

The board needs metrics that connect human behavior to risk reduction, operational resilience, and value protection.