Insider Threat

An insider threat occurs when an individual with authorized access to a protocol's systems or keys uses that access for malicious purposes. This could be a developer, a system administrator, or a member of the governance team.

Because they already have the necessary permissions, their actions are often harder to detect than external attacks. Preventing insider threats requires strict separation of duties, comprehensive logging, and multi-party authorization for all sensitive actions.

It is one of the most difficult security challenges to mitigate.