Malicious, Mistaken or Shadow IT?

About this interactive

What you are doing: sorting insiders by the kind of threat they pose. An internal threat is a malicious or negligent individual inside the organization. Intentional: someone inside actively working against the company, for espionage, for money, or to get back at it. Unintentional: someone who poses a threat without meaning to, by misconfiguring equipment so attackers can get in, or by being tricked through social engineering into giving access away. Shadow IT sits in between: an employee who brings in a device, software or service without IT's knowledge, to get work done. The motive is good, but it skips the processes that keep the company secure. How to use it: ask whether the person meant harm. If yes, intentional. If not, ask whether they made a mistake or were fooled, or whether they knowingly went around IT for a business reason.

What you'll learn

Distinguish an intentional insider threat (someone inside acting to harm the organization) from an unintentional one (a mistake, or a user tricked by social engineering)
Recognize shadow IT: a device, software or service brought in without IT's knowledge, outside the processes that keep it secure

Aligned to

CompTIA Security+

2.1 Compare and contrast common threat actors and motivations.

2.2 Explain common threat vectors and attack surfaces.

Key terms

Insider Threat: A security risk that originates from individuals who have authorized access to an organization's systems — such as employees, contractors, or partners — and misuse that access either maliciously or through negligence.
Shadow IT: The use of unauthorized software, systems, or services within an organization without IT department knowledge or approval. Shadow IT creates security blind spots because unmanaged assets fall outside standard patching, monitoring, and access controls.
Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Threat Actor: An individual or group responsible for a security incident or attack.

Topics

Insider Threat Shadow It Social Engineering Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →