Which of the following is a common source of data leakage when the main actor is a well-meaning insider?

Which of the following is a common source of data leakage when the main actor is a well-meaning insider?

• A. A disgruntled employee for a job with a competitor
• B. Lack of training and awareness
• C. A malicious insider
• D. External phishing attack

Answer: (B)

When the main actor is a well-meaning insider, the most common path for data leakage is human error stemming from lack of training and awareness. Even with good intentions, often an employee doesn’t recognize what counts as sensitive information, doesn’t know the proper handling procedures, or isn’t aware of which channels are approved for sharing data. Without clear guidance and ongoing education, they may accidentally email a file to the wrong recipient, save data to personal or unsecured devices, or use insecure methods to transmit information. Training and awareness programs teach staff how to classify data, follow approved workflows, and recognize risky situations, which directly reduces these inadvertent leaks. The other scenarios involve different dynamics. A disgruntled employee may leak data on purpose, which is a different risk class tied to intent. A malicious insider explicitly intends to exfiltrate, which isn’t about lack of awareness. An external phishing attack involves threat actors outside the organization, not an insider, so it doesn’t fit the described situation.

When the main actor is a well-meaning insider, the most common path for data leakage is human error stemming from lack of training and awareness. Even with good intentions, often an employee doesn’t recognize what counts as sensitive information, doesn’t know the proper handling procedures, or isn’t aware of which channels are approved for sharing data. Without clear guidance and ongoing education, they may accidentally email a file to the wrong recipient, save data to personal or unsecured devices, or use insecure methods to transmit information. Training and awareness programs teach staff how to classify data, follow approved workflows, and recognize risky situations, which directly reduces these inadvertent leaks.

The other scenarios involve different dynamics. A disgruntled employee may leak data on purpose, which is a different risk class tied to intent. A malicious insider explicitly intends to exfiltrate, which isn’t about lack of awareness. An external phishing attack involves threat actors outside the organization, not an insider, so it doesn’t fit the described situation.