- CISA has issued a refreshed Insider Threat Mitigation Guide
- New guidance covers remote work shifts and AI-driven manipulation tactics
- The 2026 Homeland Security Summit will explore edge capabilities, AI and more
The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency has released an updated version of a guide designed to help organizations identify, address and mitigate insider threats.
As federal and industry organizations work to strengthen their security postures against evolving insider and physical threats, government and industry leaders will convene at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10 to discuss cybersecurity workforce development, unmanned systems, counter-UAS coordination, edge capabilities for border and national security operations, artificial intelligence and investigative intelligence, among other topics. Register now to join the conversation shaping the future of homeland security.
CISA said Wednesday the updated Insider Threat Mitigation Guide builds on the agency’s original 2020 edition, offering a streamlined format and new resources for security and human resources professionals who manage insider threat programs.
What Are the Key Updates in the Guide?
The updated guide incorporates new case studies and statistics and consolidates sections to make the material easier to navigate. It expands on emerging workplace trends, including the continued growth of hybrid and remote work arrangements and the use of artificial intelligence to manipulate or deceive individuals within an organization. The guide also adds new content on access control, visitor screening and managing the risks associated with adverse employee separations. In addition, it directs organizations to newly released CISA resources intended to support early risk detection and overall preparedness.
Scott Breor, acting executive assistant director for infrastructure security at CISA, said insider threats continue to change as technology advances and encouraged organizations to put mitigation programs in place.
“We urge organizations to establish a mitigation program that protects key assets, prevent violence, reduce losses, safeguard sensitive data, and save lives,” Breor said. “CISA appreciates the industry and government partner feedback that informed this timely update. CISA encourages organizations to review this updated guide, assess their program, and recommended steps to bolster their threat mitigation program.”
What Are the Characteristics of an Effective Insider Threat Mitigation Program?
According to the CISA guide, the characteristics of an effective insider threat mitigation program are:
- Pinpoints critical assets and data the organization considers most valuable and worth protecting
- Evaluates risk levels tied to individual insiders based on the threat they may pose
- Addresses insider threats broadly, incorporating approaches aimed at the individual, potential victims and vulnerable areas of the organization
- Works directly with at-risk individuals who may be moving toward harmful behavior, aiming to deter and intervene before an incident occurs
- Controls and tracks access across the organization to limit harm from both deliberate and accidental actions
How Is CISA Strengthening Cybersecurity Beyond the Updated Guide?
CISA has continued to advance a range of related cybersecurity initiatives. The agency joined the FBI and international partners to issue guidance for outage communications, and it introduced a logging reference architecture intended to strengthen visibility across federal networks.
On the insider threat front, the agency previously released an infographic on assembling a multidisciplinary insider threat management team, building on the same mission the updated guide now supports.
On the procurement side, the agency issued a request for information on cyber tools worth up to $6 billion. It’s also sharpening its focus on open source software security.
Meanwhile, two contracts are advancing its technical capabilities, including a threat hunting and cyber operations support opportunity and a follow-on cybersecurity operations contract.
