Insider Threat refers to individuals who have intentionally or unintentionally abused their power and knowledge of the organization.

• A. True
• B. False
• C. Only intentional
• D. Only unintentional

Answer: (A)

Insider threats come from people who already have trusted access to systems and data, and they pose risk because of how they use that access—either on purpose or by accident. The statement is true because it covers both intentional misuse (malicious insiders) and unintentional actions (carelessness, mistakes, or misconfigurations) by those with knowledge of the organization. For example, someone deliberately stealing data is an insider threat, just as someone who accidentally misconfigures a system or falls for a phishing scam because they’re trusted inside the network also creates risk. The other options don’t fit because they narrow the threat to only one type of behavior (only intentional or only unintentional) or deny that insider threats encompass both possibilities.