Insider Risk in 2026: The Disgruntled Admin, the Careless Contractor and the Remote Hire Who Is Not Who You Think

The Texas developer whose laptop lives in New Jersey

A 60-person software firm needs a senior backend developer fast. The recruiter on the staffing platform sends over a candidate with a clean resume, a Texas address, and a portfolio on a public code site that looks like the real thing. The video interview goes well. He is a little stiff on camera, but the answers are right and the rate is reasonable.

The company ships a laptop to the Texas address. The device comes online three days later. The work is fine for the first month. Pull requests arrive at odd hours, which the engineering lead puts down to a night-owl habit.

Then the IT administrator, doing a routine check, notices two things. The laptop has never once been in Texas. It connects from a house in New Jersey, next to four other machines from four other companies, all running a remote-control tool nobody authorized. The second thing: the developer's video calls come from a different country entirely. The face on camera is one person. The hands on the keyboard are somewhere else.

The firm cuts access within the hour. What keeps the founder awake is not the wasted salary. It is that for five weeks a stranger had a valid account in the code repository that holds the product, and nobody had looked at what it had cloned.

What the heck does this mean

Insider threat is harm that comes from someone who has legitimate access: an employee, a contractor, a vendor, or somebody pretending to be one of those. It comes in three flavors, and only one of them is angry.

The malicious insider is the administrator who was passed over for a raise and still has the domain password, or the salesperson who exports the customer list the week before resigning.

The careless insider is the contractor who reuses a password from a breached site or shares a login "just to get the project done." No intent. Same result.

The fraudulent insider is the newest variety. A person is hired under a false identity, often with a real citizen fronting the interview or the paperwork, and the actual work is done from overseas. The joint advisory of 31 July 2026 describes North Korean IT workers operating this way, increasingly as teams. A laptop farm is the house where the company-issued laptops sit, plugged in and remotely controlled, so the connection appears domestic.

Offboarding is what most owners think of as HR paperwork. It is a security control. The account you forgot to close is the one that gets used.

The numbers that matter

Two New Jersey laptop-farm operators were sentenced in 2026 to a combined 200 months for placing North Korean workers at more than 100 US companies, according to the US Department of Justice. A hundred companies, most of them presumably with an HR process they were proud of.

Eleven governments issued a joint advisory on 31 July 2026 warning that these workers now operate in teams, sharing the same fake identity so that the person who passed the interview is never the person doing the job. The advisory is a plain-language document and it is worth reading before your next remote hire.

62% of breaches involved a human element, per the Verizon 2026 Data Breach Investigations Report. Some of those humans were tricked. Some were careless. Some were never who they said they were.

What to do this week

1. List every active account in your core systems and match each one to a living, current employee or a named contractor with an end date. Anything unmatched gets disabled today. (CIS 5 Account Management)
2. Write the offboarding checklist per role and run it the same day someone leaves, with a second person confirming. Shared passwords the leaver knew get changed, not "eventually," that day. (CIS 5 Account Management)
3. Give administrators a separate admin account they use only for admin tasks, and reduce everyone else to the access their job needs. The developer did not need the whole repository. (CIS 6 Access Control Management)
4. Turn on the logs that answer "who downloaded what": file exports, bulk downloads, repository clones, and sign-in locations. Then have someone read them weekly. Five weeks of silence was the real failure. (CIS 8 Audit Log Management)
5. Add identity checks to remote hiring: a live ID check on camera, a laptop shipped only to the verified address, and a first-week location check on the device. Brief hiring managers on the pattern. (CIS 14 Security Awareness and Skills Training)
6. Set an alert for any remote-management or remote-desktop software appearing on a company device that IT did not install. That is the laptop-farm signature. (CIS 8 Audit Log Management)

Where AccuSights fits

Our assessment starts with the question that catches most insider problems: who has access to what, and does anyone still know why? We map accounts to people, admin rights to roles, and logs to whether anyone reads them. The Cyber Hygiene Test takes three minutes and shows the first gaps. For the harder conversation about hiring and offboarding, book 15 minutes with an engineer.

Questions people ask

How do I verify a remote hire's identity? Do at least one live video interview where the candidate holds their government ID to the camera and answers unscripted questions about their own resume. Ship the laptop only to the address on the ID and the tax paperwork, and check that the device actually connects from the state or country the person claims to live in. Ask a former manager for a reference by phone, on a number you find yourself. Fraudulent hires fail one of those steps almost every time.

What access should be removed the day someone leaves? All of it, before the exit conversation ends: email, cloud drives, the accounting system, the customer database, code repositories, remote access tools, shared passwords they knew, and any API keys or service accounts they created. Change shared credentials the same day. Keep a checklist per role so nobody has to remember from scratch, and have a second person confirm it was done.

Is a laptop farm illegal for the host? In the United States, yes. The two New Jersey operators sentenced in 2026 were prosecuted for hosting company laptops so that North Korean workers could appear to be working from American homes, and the combined sentence came to 200 months. Anyone approached to "keep a few laptops running" for a fee is being recruited into that scheme, and the companies that shipped the laptops are its victims.

The badge, the login and the laptop all say who a person is supposed to be. The logs say who they are.