Insider Risk for SMEs: You Don’t Have to Be Hacked to Lose Data
SME takeaway
Your business does not need to be hacked from the outside to lose data.
Sometimes the risk comes from access you already gave to employees, contractors, suppliers, or former staff.
Most SMEs picture cybersecurity as hackers, malware, phishing emails, or criminals trying to break in. That risk is real - but not the only one.
The numbers are a warning sign
13%
sold logins or knew someone who had
Said they had sold logins or knew someone who had.
13%
said selling access was justifiable
Behaviour, pressure, culture, and controls - not just tech.
24%
accepted secret competitor work
Relevant to client data, pricing, strategy, IP, and confidential documents.
Cifas research published in 2026 found that 13% of UK employees said they had sold company login details or knew someone who had. It surveyed 2,000 UK employees aged 18+ in companies with 1,000+ employees. The same research found that 13% said selling system access was justifiable. Cifas also reported that 24% believed it was acceptable to secretly work for a competitor.
For SME owners, the lesson is simple: data can be exposed through accounts, permissions, devices, shared files, supplier access, or old logins that should have been removed.
This is not about blaming employees
That does not mean every employee is a threat. Most people are honest and want to do the right thing.
But trust alone is not a security control. Passwords get reused. Files are shared with the wrong person. Contractors receive too much access. Former employees keep accounts too long. In some cases, access is misused because of money, pressure, revenge, or personal advantage.
Malwarebytes adds the cyber angle: compromised employee credentials can become a route into company systems, customer data, and internal assets.
What SMEs should control first
Practical access checklist
The answer is not paranoia. It is management.
A working cybersecurity and ISMS approach helps SMEs control access before it becomes a data breach.
You cannot remove insider risk completely - but you can stop ignoring it.
Trust people. Control access. Verify what matters.
Once you treat access as a business risk, not just an IT issue, you can start managing it properly.
Sources
Found this useful?
Book a call
I work with organisations across Europe on NIS2 compliance, penetration testing, and security strategy. Practical advice, no overselling.
