Insider Risk for SMEs: You Don’t Have to Be Hacked to Lose Data
SME takeaway
Your business does not need to be hacked from the outside to lose data.
Sometimes the risk comes from access you already gave to employees, contractors, suppliers, or former staff.
Most SMEs picture cybersecurity as hackers, malware, phishing emails, or criminals trying to break in. That risk is real - but not the only one.
The numbers are a warning sign
13%
sold logins or knew someone who had
Said they had sold logins or knew someone who had.
13%
said selling access was justifiable
Behaviour, pressure, culture, and controls.
24%
accepted secret competitor work
Relevant to client data, pricing, strategy, IP, and confidential documents.
Cifas research published in 2026 found that 13% of UK employees said they had sold company login details or knew someone who had. It surveyed 2,000 UK employees aged 18+ in companies with 1,000+ employees. The same research found that 13% said selling system access was justifiable. Cifas also reported that 24% believed it was acceptable to secretly work for a competitor.
For SME owners, the lesson is simple: data can be exposed through accounts, permissions, devices, shared files, supplier access, or old logins that should have been removed.
Trust alone is not a control
Most people are honest and want to do the right thing. Trust is still not a security control. Passwords get reused. Files are shared with the wrong person. Contractors receive too much access. Former employees keep accounts too long. In some cases, access is misused because of money, pressure, revenge, or personal advantage.
Malwarebytes adds the cyber angle: compromised employee credentials can become a route into company systems, customer data, and internal assets.
What SMEs should control first
Practical access checklist
- Multi-factor authentication
- Least-privilege permissions
- Regular access reviews
- Fast, complete offboarding
- Supplier and contractor controls
- Logging and incident response
The answer is management.
A working cybersecurity and ISMS approach helps SMEs control access before it becomes a data breach.
You cannot remove insider risk completely - but you can stop ignoring it.
Trust people. Control access. Verify what matters.
If your identity estate runs on Active Directory or Entra ID, an Active Directory security assessment is the fastest way to see who really has privileged access today. Keeping those reviews on a schedule is part of the Retained Security Partner engagement.
Once you treat access as a business risk, you can start managing it properly.
Sources
Found this useful?