Expert Interviews Shape Human Insider Threat Framework in Three Sectors

Interviews with 15 cybersecurity experts in government, healthcare and cybersecurity produced a Human Insider Threat, or HIT, framework describing human factors associated with security violations. The qualitative study separated five proposed drivers—awareness, caring, devotion, selfishness and access—from four solution characteristics labeled advantageous, felicitous, transparency and alignment. Leadership appears in both parts of the model because participants associated senior decision-makers with organizational conditions that can either enable risky behavior or reinforce secure practices. The findings provide a practitioner-derived conceptual model, rather than a validated tool for predicting which employee will misuse access.

Researchers used semi-structured interviews conducted through secure video conferencing, with each session lasting approximately 45–60 minutes. Participants were recruited through professional cybersecurity networks and represented 13 organizations. Their average tenure in their respective roles was 18 years. All 15 had at least 12 years of information security or information technology experience, and seven had more than 20 years in cybersecurity. Thirteen participants, or 86 percent, held a CISSP or comparable cybersecurity certification. Their occupations included senior analysts, director of security, chief technology officer, chief information security officer, cybersecurity training developers, auditors and consultants.

The project followed grounded theory because its aim was to develop a framework from the experiences of people familiar with human-factor-related insider threats. Using a Straussian approach, the researchers recorded and transcribed the interviews, manually coded the material and then imported it into NVivo for further comparison and organization. Two researchers independently coded transcripts and resolved discrepancies through discussion. Their initial line-by-line analysis generated more than 500 codes. Interviews were examined in rounds of four or five, and collection and analysis continued until the researchers judged that categories were saturated and the concepts could be defined and explained.

The coding proceeded through initial, axial and selective stages. Initial coding identified two broad categories, drivers and solutions, with individual, technological and organizational subcategories under drivers. Axial coding then examined causal conditions, strategies, contextual or intervening conditions and consequences. Selective coding related these elements into the HIT framework. During this process, the researchers distinguished four psychologically refined categories of incidents according to whether employees were witting or unwitting and whether their intent was malicious or non-malicious. The study included examples of the first three combinations but found no observed case of an employee unknowingly committing an infraction with malicious intent.

The analysis showed that insider incidents could not be explained by malicious intent alone. A healthcare cybersecurity professional described employees who might work around controls or leave a workstation open to deliver care without intending harm. Their reasons included completing assigned work and working more quickly, rather than causing damage. Across the coded material, 48 instances concerned non-malicious misconduct, accounting for 22 percent of all insider-threat driver codes. Another 23 codes, or 11 percent, concerned limited awareness. Forty codes, representing 18 percent, were associated with deliberate selfishness expressed through revenge, disgruntlement, personal gain, embezzlement or ego. These counts describe patterns in the researchers’ coding of interview material, not incidence rates among all employees.

Technological conditions generated 41 codes, equal to 19 percent of the driver total. Included were access, auditing, authentication, computer literacy, outdated technology and cross-domain violations. Respondents mentioned the word “access” 57 times and described administrative privileges as a recurring concern. They also described how the time required to obtain system access could interfere with an employee’s work, encouraging shortcuts around normal procedures. The study did not directly measure how often individual technologies produced violations. Instead, the interviews identified access and its surrounding controls as recurring elements in participants’ accounts of how insider-threat activity unfolds.

Leadership and leadership culture were the most pervasive factors in the coded material. Leadership-related codes accounted for 31 percent of the driver categories and 42 percent of the solution categories. Participants described situations in which senior executives prioritized convenience over patching, authentication or other protections, visibly signaling that some rules were optional. Other interviewees described leaders who followed policies, supported cyber programs and built positive relationships with employees, encouraging greater organizational buy-in. These are participants’ reported experiences and associations rather than measured estimates of how leadership changes incident rates, but the interviews consistently placed leadership between organizational culture, employee conduct and the implementation of security controls.

Communication was the most frequently discussed code and was closely connected with training, culture and incident reporting. One government cybersecurity professional argued that an excessively punitive policy could discourage employees from reporting mistakes, depriving the organization of opportunities to learn from violations. Participants also criticized standardized online training that changed little over time or failed to address the particular errors employees had made. They pointed to role-relevant education, remedial instruction and simulation exercises, including phishing simulations, as ways to examine behavior and identify where additional support might be needed. Leadership was described as an important agent of transparent communication, especially when policies paired accountability with opportunities for employees to report problems without fear.

The HIT framework organizes the results into drivers and proposed solutions. The driver characteristics concern awareness, caring, devotion, selfishness and access, while the solution characteristics are presented as advantageous, felicitous, transparency and alignment. The researchers did not provide operational definitions for all four solution terms, so the framework’s proposed uses come from their broader qualitative findings. These include creating training and security programs that employees find useful and appropriate for their duties, communicating policies transparently, and aligning technology access with job responsibilities. The model is intended as a foundational structure for developing assessments and instruments, not as an existing predictive scale or a guarantee that an intervention will prevent misconduct.

The authors mapped the HIT factors to the six functions in version 2.0 of the National Institute of Standards and Technology Cybersecurity Framework: govern, identify, protect, detect, respond and recover. In that mapping, human-factor information helps organizations understand why controls may succeed or fail, while leadership influences governance and the normalization of secure behavior. Alignment of technology with duties is especially relevant because an access system that obstructs urgent work may encourage employees to seek workarounds; permissions matched to actual responsibilities can instead limit unnecessary opportunities for misuse. The framework therefore places human decisions within a wider process involving organizational culture, policy, training and technical systems rather than treating technical detection alone as a complete response.

Several limitations constrain the conclusions. The purposive sample was small, concentrated in three sectors and composed of highly experienced, often highly certified cybersecurity professionals. Non-disclosure agreements prevented participants from identifying their organizations or describing many individual incidents in detail. The researchers did not interview employees who had personally carried out insider violations, so their evidence about offender motivations and behavior comes from security professionals rather than direct accounts of those responsible. A compressed project timeline, participants’ organizational roles and differences in exposure to incidents may also have shaped the findings. The authors propose validation through larger and more diverse samples, organizational case studies, behavioral experiments, survey development and integration of the framework in industry settings. Until then, the HIT framework summarizes reported drivers and possible responses from a limited expert sample; it does not demonstrate that a particular employee will misuse access or that a particular intervention will eliminate insider incidents.

Subject of Research: A qualitative study of human and organizational factors associated with cybersecurity insider threats.

Article Title: Grounded theory insights into human insider threats: a qualitative study of expert perceptions

Article References: Green, M. L., Dozier, P. D., & Owusu, E. (2026). Grounded theory insights into human insider threats: a qualitative study of expert perceptions. Frontiers in Computer Science, 8, 1854879. https://doi.org/10.3389/fcomp.2026.1854879

Image Credits: AI Generated

DOI: 10.3389/fcomp.2026.1854879

Keywords: insider threats, cybersecurity, human factors, grounded theory, expert interviews, organizational culture, employee behavior, access control, security leadership, cybersecurity training, Grounded, theory