Supply Chain vs Insider Threat

The Axios NPM package was downloaded 100 million times per week.

Malware operators compromised 350 GitHub repositories to inject malicious code into JavaScript and Python projects.

DPRK-nexus adversaries injected malicious packages into AI frameworks, poisoning 131 trusted AI framework packages.

In 1H 2026, 87% of identified software registry threats involved malicious npm packages.

eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

Supply chain attacks generated 280.6 million victim notices from 38 initial breach events, impacting 206 entities.

48% of organisations continue working with suppliers despite known resilience or security concerns.

26% of organisations identify dependence on suppliers as a main barrier to improving resilience.

89% of businesses assess supplier resilience at onboarding.

Nearly a quarter (24%) of 17,651+ tracked Model Context Protocol (MCP) servers carry at least one vulnerability.

28.6% of 130,667 cataloged tools are classified as high risk.

38% of restaurant chains say reliance on third-party vendors increases their cyber risk.

62% of restaurant chains work with six or more third-party vendors per location.

28% of restaurant chains had third-party platform data exposed in the past year.

28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.

Insider wrongdoing events totaled 21 in the first half of 2026, a sevenfold increase over the three incidents in 2025.

50% of federal IT and cybersecurity decision makers list preventing unauthorized actions as a top concern for agentic AI deployments

41% of CISOs are concerned about malicious insiders using AI to support fraud, cybercrime or data theft.

68% of CISOs identify employees as their organisation’s biggest security risk as AI amplifies human-targeted attacks.

40% of CISOs fear employees are sharing sensitive information with generative AI platforms.

38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.

12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.

80% of organizations report shadow AI (employees connecting AI tools without security or IT review).

17% of Nordic CISOs cited insiders & human error as their primary concern.

Over a third of employees commonly source their own agentic AI tools when options are unavailable or restrictive.

Shadow AI is now the third most common non-malicious insider action detected in Verizon's data loss prevention (DLP) dataset in 2025

13% of employees say they’ve sold or know someone who has sold company login details – often under the belief it’s harmless

90% of organizations experienced at least one insider incident in the past 12 months.

74% of organizations rank negligent insiders as their top concern, surpassing compromised accounts (65%) and malicious insiders (59%).

45% of organizations classify AI copilots and generative AI tools as insider risk.