In the Bitkom Wirtschaftsschutz 2026 survey, 19 per cent of affected companies name (former) employees acting intentionally as perpetrators, and a further 23 per cent name employees acting unintentionally. According to IBM, data breaches caused by malicious insiders cost an average of 4.92 million US dollars, making them the most expensive of all attack vectors.
Why surveillance is not the answer
The obvious reaction is control: more logs, more analysis, more mistrust. This has limits, both legal and human. Data protection and co-determination rights set narrow boundaries. And a culture of mistrust produces exactly what approaches need: people who feel unseen and unappreciated.
What actually works
- Managers who notice changes in people and address them without casting suspicion.
- A reporting channel through which suspicious contacts can be raised without embarrassment and without consequences for the person reporting.
- Clean processes when people leave: access rights, devices, exit conversation.
- Need-to-know instead of access for everyone.
- Training that turns staff into allies rather than suspects.
The warning signs
The specialist literature describes recurring patterns: lasting resentment after conflicts or missed promotions, sudden financial strain or conspicuous wealth, unusual interest in information outside one's own remit, new contacts that are not talked about. None of these signs proves anything. Together, they are a reason for a conversation, not for an investigation.
Where there is a specific suspicion, the case belongs with the competent authorities.
Further reading: Bitkom, Wirtschaftsschutz 2026 · IBM, Cost of a Data Breach 2025
