The Threat Is Already Inside: Why Honeytokens Catch Insiders That DLP, UEBA, and SIEM Can't

In May 2025, Coinbase discovered that a group of its own support agents had been bribed by external attackers to exfiltrate customer data. The insiders used their legitimate access privileges — the same access they needed to do their jobs — to steal data from 69,461 users. The attackers demanded a $20 million ransom. Coinbase refused, but the damage was done: bribed employees, stolen data, and a serious reputational hit for one of the world's largest cryptocurrency exchanges.

Two months earlier, a trading desk analyst at a global investment bank exfiltrated proprietary trading algorithms valued at $120 million. In January 2025, a senior engineer at a semiconductor company transferred next-generation processor designs worth $1.5 billion in R&D investment to a competitor before resigning. At Intel, departing employee Jinfeng Luo downloaded roughly 18,000 sensitive files, and when DLP blocked one attempt, he simply switched to a different device.

These aren't edge cases. They're the new normal. The DTEX/Ponemon 2026 report found the average organization spent $19.5 million on insider risk in 2025, up from $17.4 million the year before. Flashpoint observed 91,321 instances of insider recruiting, advertising, and threat actor discussions on underground forums in 2025 alone, averaging over 1,100 posts per month. And 93% of security professionals now say insider attacks are as difficult or more difficult to detect than external breaches.

The insider threat isn't hypothetical. It's a $19.5 million annual problem your current security stack was never designed to solve. I've run the incident response on enough of these to know how the conversation usually goes: the access was legitimate, the logs look clean, and nobody can say when it started.

Three faces of insider threat, and why each one evades detection

The old stereotype of the disgruntled employee stealing files on their last day is dangerously narrow. Modern insider risk comes in three forms, and traditional tools struggle with all of them.

The negligent insider (55% of incidents). This is the employee who clicks the phishing link, misconfigures the S3 bucket, shares credentials over Slack, or uses shadow IT tools that route around your DLP. Non-malicious insiders accounted for 75% of all incidents in Ponemon's 2025 study, with negligent employees causing 55% of events. Each organization saw an average of 13.5 negligent insider incidents per year. Fortinet's 2025 report found 72% of organizations lack visibility into how users handle sensitive data, and 77% faced insider-driven data loss in the past 18 months.

The malicious insider (25% of incidents). This is the departing engineer who downloads IP before their last day, the bribed support agent, the employee selling access on Telegram. Malicious insider incidents carry the highest per-breach cost at $4.92 million, exceeding the $4.44 million global average for all breaches. Verizon's 2025 DBIR found 89% of privilege misuse cases are financially motivated. And 70% of IP theft happens within 90 days of an employee's resignation announcement, a predictable window most organizations still fail to monitor effectively.

The compromised insider (20% of incidents). This is the employee whose credentials have been stolen through phishing or infostealer malware, letting an external attacker operate under their identity. These incidents are the costliest on a per-event basis at $779,797, because the attacker inherits all of the employee's legitimate access. Once inside with valid credentials, they blend into normal activity for months. IBM's breach research found combined lifecycles for credential-based and malicious insider activity averaging 292 days. We trace how those credentials get harvested in our piece on the infostealer epidemic and MFA bypass.

What all three categories share is one detection challenge: the insider is using authorized access. They have the credentials. They have the permissions. They're touching systems they're supposed to touch. The line between legitimate work and data theft often comes down to intent, and no security tool can read minds.

Why DLP, UEBA, and SIEM keep failing against insiders

The security industry has thrown billions at insider threat detection. Yet only 25% of organizations report a fully mature insider risk program, and the average detection and containment time for insider incidents is still 81 days. Here's why the dominant tools keep underperforming.

DLP blocks known patterns, not unknown intent. Data Loss Prevention tools exist to stop specific data types from leaving through specific channels. When Intel's DLP blocked Jinfeng Luo's first exfiltration attempt, he just used a different device. DLP can't anticipate every exfiltration method, and sophisticated insiders know how to work around the rules. Fortinet's research confirms that legacy DLP tools built for data in motion are no longer enough against insider-driven exposures.

UEBA drowns in false positives. User and Entity Behavior Analytics establish behavioral baselines and flag deviations. The trouble is that normal employee behavior is wildly variable. A legitimate late-night deadline looks like anomalous after-hours access. A valid project handoff looks like unusual data transfer. When 90% of security professionals say insider attacks are harder to detect than external attacks, it's because UEBA baselines are too noisy to separate legitimate work from malicious intent. The signal-to-noise ratio makes the alerts impractical to investigate at scale.

SIEM correlation is too slow. SIEM rules can detect known attack patterns, but insider data theft rarely follows a recognizable signature. A malicious insider accessing files they're authorized to view, downloading them through approved channels, and exfiltrating via personal devices generates no SIEM alerts. By the time correlation rules surface a suspicious aggregate pattern, 81 days of undetected access have already passed.

The root problem is authorized access. DLP, UEBA, and SIEM all assume a clean line between authorized and unauthorized activity. Insiders operate entirely inside the authorized zone. They have the permissions. They have the access. They use the same tools and workflows as everyone else. When the threat uses your own access model against you, detection tools built on that same model can't help.

How honeytokens catch insiders when everything else fails

Honeytokens solve the insider threat problem by sidestepping the authorization question entirely. Instead of trying to judge whether authorized access is being used with malicious intent — an inherently subjective call that drives false positives — honeytokens plant decoy assets that no one, regardless of access level, should ever touch.

A honeytoken file in a shared drive named "Executive_Compensation_2026.xlsx" has no business being opened by a departing engineer in the marketing department. A honeytoken database record that looks like a VIP customer account has no business being queried by a support agent who was just bribed. A honeytoken API key in a code repository has no business being tested by a developer planning to leave for a competitor.

Any interaction — any access, any download, any query — is definitively unauthorized. Zero false positives. An immediate, high-confidence signal that someone is reaching data they shouldn't, regardless of whether their credentials technically permit it. Our walkthrough of how Mine2 detected insider data theft at an IT services firm shows exactly how that signal plays out in a real investigation.

Honeytoken documents catch data staging and IP theft

The most common insider data theft pattern is bulk downloading before departure, and 70% of IP theft happens within 90 days of resignation. Mine2 honeytokens planted as enticing-looking documents in shared drives, document management systems, and collaboration platforms act as tripwires. Fake board presentations, decoy product roadmaps, bogus financial models, and honeytoken customer lists scattered across file shares catch the moment someone starts systematically opening sensitive-looking documents across organizational boundaries.

When a departing employee begins downloading everything they can find, the honeytoken document they inevitably open fires an alert, with their identity, the timestamp, and the access vector, days or weeks before their last day.

Honeytoken database records detect unauthorized queries

The Coinbase breach succeeded because bribed support agents used their legitimate query access to exfiltrate customer data. Traditional monitoring couldn't tell agents doing their jobs apart from agents stealing data.

Mine2 honeytoken records planted inside production databases — fake customer accounts, decoy transaction records, bogus PII entries — fire when queried. If a support agent queries a honeytoken customer record, the alert is immediate and unambiguous. No behavioral baseline needed. No subjective judgment about whether the query was work-related. The record is fake, so any access is definitively unauthorized.

Honeytoken credentials catch compromised insiders

For the compromised insider, the employee whose credentials have been stolen by an external attacker, honeytokens planted in credential stores, browser caches, and config files act as canaries. When infostealers harvest credentials from a compromised endpoint, they sweep up honeytokens alongside the real ones. The moment the attacker tries to use a honeytoken credential, the alert fires, revealing that the employee's identity has been compromised before the attacker can do damage with real credentials.

MineField decoy services detect internal reconnaissance

Before an insider can steal high-value data, they need to find it. The reconnaissance phase — scanning internal networks, probing databases, testing access to systems outside their normal scope — is where MineField catches insiders. Decoy services deployed on network segments the insider's role doesn't normally touch trigger the moment an unauthorized scan or connection attempt occurs. This is the same lateral-movement detection we cover in our analysis of a PAM breach and credential Mines at BeyondTrust.

Cloud Mines detect cloud data exfiltration

As data increasingly lives in cloud environments, insiders exfiltrate through cloud channels: copying data to personal cloud storage, cloning repositories, downloading from SaaS platforms. Mine2's Cloud Mines — honeytoken cloud resources that monitor for unauthorized access — fire when insiders interact with decoy cloud assets, catching cloud-based data theft that DLP and CASB tools often miss.

A practical playbook: honeytokens for insider threat programs

1. Map your crown jewels, then plant honeytokens alongside them

Identify your most valuable data assets: IP, customer data, financial records, strategic plans. For each category, create matching honeytokens and plant them in the same systems, shares, and databases where the real assets live. The insider targeting your real crown jewels will inevitably run into the fakes.

2. Deploy honeytoken documents in every file share

Create realistic honeytoken documents — "Board_Strategy_2026.pptx", "M&A_Targets_Confidential.pdf", "Employee_Salary_Database.xlsx" — and place them in shared drives, SharePoint sites, and document management systems. These are especially effective during the 90-day resignation risk window.

3. Seed honeytoken records in production databases

Work with database administrators to insert honeytoken records that look like real data but are flagged for monitoring. In CRM databases, create fake high-value customer accounts. In HR systems, create decoy employee records. In financial systems, create bogus transaction entries. Any query touching these records is an insider indicator.

4. Plant honeytoken credentials on high-risk endpoints

For employees in sensitive roles (finance, engineering, support), plant honeytoken credentials on their workstations. If an endpoint is compromised by an infostealer, the honeytoken credential is harvested and eventually used, revealing the compromise before real credentials are exploited.

5. Focus MineField decoys on cross-boundary access

Deploy MineField decoy services on network segments that separate organizational boundaries: engineering from finance, R&D from sales, production from development. An insider crossing these boundaries to reach data outside their normal scope trips a MineField alert.

6. Harden with Fortify and layer deception on top

Use Mine2's Fortify to enforce least privilege, disable dormant accounts, restrict broad data access, and surface privilege creep. Then layer honeytokens on top of hardened access controls, so even when an insider has more access than they should, the next thing they touch might be a trap.

What I keep coming back to

The insider threat costs organizations $19.5 million annually, takes 81 days to detect, and is considered harder to identify than external attacks by 93% of security professionals. Traditional tools — DLP, UEBA, SIEM — struggle because insiders operate with authorized access, which makes malicious activity indistinguishable from legitimate work.

Honeytokens get around that limitation. They don't try to read intent. They don't establish behavioral baselines. They don't generate false positives. They plant assets no one should ever touch, and they fire the moment anyone does, regardless of role, permissions, or access level.

In a threat landscape where external attackers recruit insiders on Telegram at 1,100 posts per month, where 70% of IP theft lands in the resignation window most organizations fail to monitor, and where bribed support agents can exfiltrate data from tens of thousands of customers using the access they were given to do their jobs, the detection method that doesn't depend on separating legitimate from malicious access is the one that actually works.

---

Want to catch insiders before they walk out the door with your data? See how Mine2's honeytokens detect insider threats with zero false positives →