As National Insider Threat Awareness Month comes to a close, organizations have an opportunity to consider how insider-risk programs must evolve. The month has traditionally focused on employees, contractors and compromised accounts that misuse legitimate access. As organizations introduce AI assistants and autonomous agents into everyday operations, that risk increasingly includes nonhuman identities with access to sensitive data, business applications and development systems.
The underlying challenge remains the same: trusted access can create risk when it is too broad, poorly monitored or no longer appropriate. What has changed is the number of identities with that access and the speed at which they can act.
Physical access remains part of the insider-risk picture
Conversations about insider threats often center on digital systems, but trusted access also includes buildings, restricted areas and physical assets. Effective programs need to connect access permissions with reliable video and clear operating procedures so teams can establish what happened and respond based on verified information.
Chris Robertson, Director, Technical Consultant Team, Luminys:
“After more than 25 years working in physical security, one thing I’ve learned is that managing insider risk often comes back to the fundamentals. Who has access to a physical space? Are those access permissions still appropriate for that person’s role? And can the security team quickly verify what happened when an incident occurs? Effective access control, video security and strong operating procedures give organizations the visibility they need to identify potential insider threats, investigate incidents and act on what they can verify.
Technology has improved considerably, especially when video security, access control and search tools work together, but good security still depends on how teams design and manage the system every day. Teams must review permissions. Video needs to be usable when an investigation happens. Operators need tools they understand and trust. Insider Threat Awareness Month is an essential moment to take a closer look at those basics and make sure the physical security program is doing what the organization expects it to do.”
AI agents bring insider risk into the software supply chain
As AI agents take on more responsibilities in software development, insider risk is extending into code repositories, development pipelines and production environments.
Hari Srinivasan, Vice President of Products & Strategy, Lineaje:
“Insider Threat Awareness Month can no longer focus solely on human actors. Today, enterprise insider risk extends to autonomous software agents operating inside development pipelines. Organizations are granting AI agents privileged access to private repositories, CI/CD systems, package managers, skills repositories, and systems of record. Functionally, these agents act as credentialed insiders: they select third-party packages, write and refactor code, and push commits directly into trusted environments. Further, they can access, process, transmit, and transform data from systems of record, as well as from external models and other agents.
When an autonomous agent is untracked or misgoverned, it not only introduces bugs, but also injects supply chain risk directly into production builds at machine speed, and could leak sensitive and business-critical data. To contain this emerging vector, security teams must treat every AI agent as an insider and a potential actor involved in the software supply chain. That demands complete visibility into package, model, skills, MCPs and third-party agent provenance, along with continuous assessment of agent-generated code. Enforce automated policy control and governance that neutralize vulnerable or malicious components and actions before impact.”
Carrying the conversation beyond September
Insider risk now spans physical spaces and digital systems, with organizations responsible for managing access across both human and machine identities. Access should be regularly reviewed, monitored and tested as roles and systems change—work that must continue beyond Insider Threat Awareness Month.
