PROJECT: INSIDER THREATS
PLEASE SHARE THIS PUBLIC DOCUMENT
WHEN THE CRIMINAL ALREADY HAS ACCESS
Not every security breach begins with a forced entry, a stolen password or an unfamiliar person attempting to gain access.
In some cases, the individual responsible already has legitimate access to the premises, systems, information
or people being targeted. This makes insider threats particularly difficult to identify because the person may be trusted,
familiar with security procedures and aware of weaknesses that are not visible to outsiders.
An insider threat involves the misuse of legitimate access by an employee, contractor, service provider
or another authorised individual. The threat may be intentional, motivated by financial gain, revenge, coercion
or personal grievances. It may also arise when a trusted person is manipulated, deceived or compromised by an external criminal. Not every insider-related incident involves deliberate criminal conduct, but organisations must recognise
that legitimate access does not automatically guarantee trustworthy behaviour.
HOW INSIDER THREATS DEVELOP:
Employees and service providers often have access to sensitive information, restricted areas, security systems, financial records, client databases or operational procedures. Criminals may exploit this access directly or persuade an authorised person to provide information or assistance.
An employee may disclose confidential information, manipulate transactions, remove stock, share access credentials or facilitate unauthorised entry. A contractor may exploit knowledge of a property's layout, security arrangements or maintenance schedules. A service provider may have access to personal information, keys, alarm systems or digital platforms that could be abused.
In more complex cases, an external criminal may recruit or coerce an insider to supply information, disable security measures, identify valuable targets or assist with fraud and theft. A compromised insider may not initially understand the full purpose of the information being requested, particularly when the criminal disguises the activity as legitimate business.
WHY INSIDER THREATS ARE DIFFICULT TO DETECT:
The primary difficulty is that the individual may not appear suspicious. They may possess valid credentials, know the correct procedures and understand which activities are unlikely to attract attention. Familiarity can create a false sense of security, causing colleagues, managers and property owners to overlook warning signs.
Insiders may also understand how access logs, surveillance systems and approval procedures operate. This knowledge can be used to conceal unauthorised activity, manipulate records or exploit gaps in supervision. In digital environments, a person with legitimate system access may be able to copy client records, obtain financial information or disclose confidential business data without immediately disrupting normal operations.
Organisations that rely exclusively on perimeter security, passwords or background checks may therefore overlook risks arising from individuals who already operate within their security boundaries.
WARNING SIGNS AND RISK INDICATORS:
Warning signs must be assessed objectively and in context. A single behaviour does not establish criminal conduct, and employees should not be treated as suspects merely because they experience financial difficulties or have disagreements at work. However, unexplained access or repeated breaches of established procedures warrant investigation.
Relevant indicators include:
Unauthorised access: Accessing files, premises, accounts or systems unrelated to an individual's duties.
Unusual information requests: Seeking confidential client details, security codes, staff schedules or financial information without a clear work-related reason.
Circumvention of controls: Repeatedly bypassing approval procedures, sharing credentials or asking colleagues to ignore security requirements.
Unexplained discrepancies: Missing stock, altered records, irregular transactions or unexplained changes to access logs.
Unauthorised disclosure: Sharing internal documents, photographs, personal information or operational details with external parties.
Conflicts of interest: Undisclosed relationships with suppliers, competitors or individuals who may benefit from confidential information.
Possible external manipulation: An employee being pressured, threatened, bribed or deceived into providing access or information.
These indicators should trigger proportionate checks and a documented review rather than immediate accusations. Evidence must be preserved, and any investigation should comply with applicable labour, privacy and criminal law requirements.
THE ROLE OF DIGITAL ACCESS AND PERSONAL INFORMATION:
Insider threats are not limited to physical premises. Employees and contractors may have access to email accounts, cloud storage, customer databases, payment platforms, identity documents and internal communication systems. If these privileges are abused, the consequences can extend beyond the organisation to customers, suppliers and members of the public.
Stolen or improperly disclosed information can be used for identity theft, impersonation, targeted phishing, account takeover, fraud, extortion and social engineering. Information that appears harmless in isolation, such as a person's telephone number, work schedule, vehicle details or relationship with a particular organisation, may become valuable when combined with other information.
Organisations should therefore restrict access to information according to actual job requirements, remove access promptly when duties change or employment ends, and monitor unusual activity. Multi-factor authentication, individual user accounts, secure audit logs and appropriate data-loss controls can reduce opportunities for abuse.
PREVENTION: REDUCING OPPORTUNITIES FOR INSIDER ABUSE
Effective prevention requires more than trusting people or installing security equipment. It depends on clear procedures, appropriate supervision, accountability and regular review of access privileges.
Organisations should apply the principle of least privilege, ensuring that individuals receive only the access necessary to perform their duties. Sensitive transactions and high-risk changes should require independent authorisation where appropriate. Shared passwords and generic accounts should be avoided because they make it difficult to establish who performed a particular action.
Access rights should be reviewed regularly, particularly when employees change roles, contractors complete projects or service agreements terminate. Background screening may be appropriate for certain positions, subject to applicable law and the nature of the role, but it cannot eliminate all risk.
Staff should receive practical training on confidentiality, social engineering, bribery, coercion and the reporting of suspicious requests. Organisations also need accessible reporting channels that allow concerns to be raised without unnecessary exposure or retaliation. Reports must be handled fairly, confidentially where possible, and without prejudging the outcome.
Physical security should follow the same principles. Visitor records, controlled key management, access restrictions, secure storage and supervision of external service providers can limit opportunities for unauthorised entry or information gathering.
WHAT SHOULD HAPPEN WHEN AN INSIDER THREAT IS SUSPECTED?
Organisations should avoid confronting a suspected individual impulsively or making unverified accusations publicly. The response should be proportionate to the risk and guided by documented procedures.
Relevant access records, emails, transaction histories, CCTV footage and other available evidence should be preserved securely. Where necessary, authorised personnel should restrict access to affected systems or premises while protecting business continuity and the rights of those involved. Passwords and access credentials may need to be changed, and compromised accounts should be secured.
Serious incidents involving theft, fraud, threats, unlawful disclosure or other suspected offences should be referred to the appropriate authorities. Organisations should obtain suitable legal or specialist assistance where necessary and maintain a clear record of the steps taken. Evidence must not be altered, unlawfully obtained or circulated indiscriminately.
PUBLIC AND BUSINESS ACTION CHECKLIST:
Individuals and organisations can reduce insider-related risks by following these measures:
Limit access: Give employees, contractors and service providers access only to what they need.
Verify requests: Confirm unusual requests for money, confidential information or access through an independent, trusted channel.
Protect credentials: Never share passwords, access cards, alarm codes or one-time verification codes unnecessarily.
Review activity: Investigate unexplained transactions, missing property, unusual downloads and unauthorised access.
Secure personal information: Avoid disclosing sensitive details about clients, staff, property or security arrangements to unauthorised parties.
Remove access promptly: Revoke keys, accounts and credentials when access is no longer required.
Report concerns: Document suspicious conduct and report it through the appropriate internal or law-enforcement channels.
Preserve evidence: Retain relevant records securely and avoid altering or publicly circulating potential evidence.
Insider threats demonstrate that security depends not only on keeping unauthorised people out, but also on managing
the access granted to those who are already inside. Employees, contractors and service providers can perform essential functions while simultaneously presenting risks if their access is abused, compromised or inadequately controlled.
Trust remains important in every working environment, but it must be supported by verifiable procedures, appropriate oversight and clear accountability. Organisations and individuals who identify weaknesses early, protect sensitive information
and respond to warning signs through lawful, evidence-based processes are better positioned to prevent insider access from becoming an opportunity for criminal activity.
Specialised Security Services (SSS), under the leadership of Mr. Mike Bolhuis, emphasises the importance of vigilance,
sound security practices and the responsible reporting of suspected criminal conduct.
Security should never depend on trust alone; it must be supported by effective controls and accountability.
Specialised Security Services invites the public to the Mike Bolhuis Daily Projects WhatsApp Channel.
This channel is important in delivering insights into the latest crime trends, awareness, warnings and the exposure of criminals.
How to Join the WhatsApp Channel:
1. Make sure you have the latest version of WhatsApp on your device.
2. Click on the link below to join the Mike Bolhuis Daily Projects WhatsApp Channel:
3. Follow the prompts to join the channel.
4. Make sure you click on "Follow", then click on the "bell"-icon (🔔)
CONTACT MR MIKE BOLHUIS FOR SAFETY AND SECURITY MEASURES, PROTECTION, OR AN INVESTIGATION IF NEEDED.
ALL INFORMATION RECEIVED WILL BE TREATED IN THE STRICTEST CONFIDENTIALITY AND EVERY IDENTITY WILL BE PROTECTED.
Regards,
Mike Bolhuis
Specialist Investigators into
Serious Violent, Serious Economic Crimes & Serious Cybercrimes
PSIRA Reg. 1590364/421949
Mobile: +27 82 447 6116
E-mail: mike@mikebolhuis.co.za
Fax: 086 585 4924
Follow us on Facebook to view our projects -
EXTREMELY IMPORTANT: All potential clients need to be aware that owing to the nature of our work as specialist investigators there are people who have been caught on the wrong side of the law - who are trying to discredit me - Mike Bolhuis and my organisation Specialised Security Services - to get themselves off the hook. This retaliation happens on social media and creates doubt about our integrity and ability. Doubt created on social media platforms is both unwarranted and untrue. We strongly recommend that you make up your minds concerning me and our organisation only after considering all the factual information - to the exclusion of hearsay and assumptions. Furthermore, you are welcome to address your concerns directly with me should you still be unsatisfied with your conclusions. While the internet provides a lot of valuable information, it is also a platform that distributes a lot of false information. The distribution of false information, fake news, slander and hate speech constitutes a crime that can be prosecuted by law. Your own research discretion and discernment are imperative when choosing what and what not to believe.
STANDARD RULES APPLY: Upon appointment, we require a formal mandate with detailed instructions. Please take note that should you not make use of our services – you may not under any circumstance use my name or the name of my organisation as a means to achieve whatever end.
POPI ACT 4 of 2013 South Africa: Mike Bolhuis' "Specialised Security Services" falls under Section 6 of the act. Read more here: https://mikebh.link/fntdpv
SSS TASK TEAM:
Copyright © 2015- PRESENT | Mike Bolhuis Specialised Security Services | All rights reserved.
Our mailing address is:
Mike Bolhuis Specialised Security Services
PO Box 15075 Lynn East
Pretoria, Gauteng 0039
South Africa
Add us to your address book
THIS PUBLIC DOCUMENT WAS INTENDED TO BE SHARED, PLEASE DO SO.
