Gurucul Research Demonstrates AI is the New Insider Threat as 90% of Organizations Experience Incidents

IRM Consortium Data Shows AI-Analyst Automation Delivers 83% ROI for Insider Threat Teams

LOS ANGELES, Calif. – March 18, 2026 – Gurucul, the global leader in insider risk management, today released its 2026 Insider Risk Report in partnership with Cybersecurity Insiders, uncovering a fundamental shift in how organizations experience, detect and manage insider threats. Based on a survey of over 700 IT and cybersecurity professionals, the report finds insider risk is no longer episodic but continuous, with artificial intelligence operating inside enterprise trust boundaries as a new class of insider. Additionally, new research from the Gurucul IRM Consortium highlights the AI Analyst as a vital force multiplier. By complementing small insider threat teams, automating complex triage, the AI Insider Threat Agent is driving an 83% ROI. 

The research reveals that 90% of organizations experienced at least one insider incident in the past 12 months, with more than half of these incidents costing half a million dollars or more to remediate. At the same time, 94% of organizations say AI adoption is increasing their insider risk exposure, and 54% acknowledge confirmed or suspected AI-related insider incidents.

Traditional insider risk models, built around static users and isolated events, are failing to keep pace with modern enterprises where risk now spans human users, machine identities and AI-driven activity. Organizations face a rapidly expanding insider threat surface as access proliferates across cloud platforms, collaboration tools, and AI-driven workflows, while nation-state actors increasingly exploit insider access and process gaps. Traditional trust models built for static users and predictable access patterns are failing to scale, exposing organizations to cascading risk from both human and non-human insiders. Effective insider risk management now requires more than visibility into individual events. It requires machine learning, behavior analytics, AI and risk  prioritization models that unify identity, behavior, access and machine activity for high efficacy incidents.

The challenge is no longer simply detecting policy violations. It is identifying subtle, cross-domain patterns of risk early enough to prioritize investigation and prevent material loss.

Key findings of the report include:

• AI has become a new insider: Nearly half of organizations (45%) now classify AI copilots and generative AI tools as insider risk, while 88% are concerned about autonomous AI agents operating as non-human insiders with privileged access.
• Negligent insiders outpace malicious actors: 74% of organizations rank negligent insiders as their top concern, surpassing compromised accounts (65%) and malicious insiders (59%), signaling a shift from intent-based threats to systemic risk exposure.
• Detection is getting harder, not easier: 53% of organizations say insider attacks are harder to detect than external cyber threats, reversing progress made in prior years as insider activity blends into cloud platforms, collaboration environments, and shadow AI tools that employees adopt faster than security teams can monitor.
• Tool sprawl is failing to deliver clarity: One-third of organizations operate five or more insider risk tools, yet 66% still struggle with detection accuracy and 58% cite tool and data fragmentation as a primary challenge.
• Insider risk is a material financial liability: More than half of insider incidents cost $500,000 or more to remediate, and 11% exceed $2 million, underscoring the growing financial impact as incident frequency rises.
• The detection–to–response gap is widening: While 57% of organizations report success using AI for alert triage and risk scoring, only 26% report success      automating incident response, exposing a widening gap between detection and containment.

Saryu Nayyar, CEO, Gurucul, said: “Insider risk has reached an architectural tipping point. AI is now an insider with delegated authority, operating inside email, documents, workflows and identities at machine speed. As much as AI is a driver for increased insider risk, it is also a catalyst for improved detection and response. Organizations must govern and monitor AI like any other insider while using advanced behavioral analytics and AI Analyst automation to defend at scale.”

Holger Schulze, CEO and Founder, Cybersecurity Insiders, added: “AI is fundamentally changing the insider risk equation. With 90% of organizations experiencing insider incidents and 94% reporting that AI is increasing their exposure, the urgency is clear: security leaders must govern AI like any other insider, with continuous visibility, behavioral analytics, and unified detection to contain risk at machine speed.”

The full 2026 Insider Risk Report is available for download here.

About Gurucul

Gurucul is a unified data and security analytics company founded in data science that delivers radical clarity about insider and cyber risk. We analyze enterprise data at scale using machine learning, comprehensive threat content, and secure artificial intelligence. Instead of useless alerts, you get real-time, actionable information about high-risk threats with automated response options. Our cloud-native platform is open and flexible, enabling you to own your data, deploy anywhere, and integrate with any security tool. To learn more, visit www.gurucul.com and follow us on LinkedIn.

PR Contact:
Shannon Van Every
Force4 Technology Communications
Shannon@force4.com