Security risk from people within the organization with legitimate access. May be malicious or negligent. Mitigated by least privilege, monitoring, and behavioral analytics.