When the traitor is working right beside you

The examples in this article are illustrative scenarios based on situations we frequently encounter. They do not refer to any specific company.

Imagine a hospital group waking up to find its systems down: surgeries rescheduled, patient records inaccessible, and a ransom demand for several million pesos. The investigation points to someone who knew the network better than anyone else: a former security manager at the company itself. It’s an extreme case, but it illustrates something that many companies in Mexico still underestimate: the attack doesn’t always come from the outside. Sometimes the attacker already has an access badge.

The most common threat isn't a traitor—it's carelessness

Before we talk about bad faith, we need to talk about distraction. Internal threats come in two forms: intentional and unintentional. The latter is by far the most common, especially since remote work has become the norm and many people use their personal computers for work as well.

• A web browser is not a safe. Storing corporate passwords in a personal computer's browser is an open invitation to infostealers—programs that silently steal credentials. If your home computer is already infected, the attacker can simply walk right in—no need to break in.
• The home has become an extension of the office. Files are copied to a USB drive, to the personal cloud, or to the NAS that a family member set up “because the internet is slow.” If that device is compromised, the company’s data goes down with it.

The answer isn't to ban remote work, but to close these loopholes: managed corporate devices, authorized storage, and an enterprise password manager.

Five Profiles of the Deliberate Threat

1. Revenge. A poorly handled termination, a denied promotion. This is the most dramatic—and the most damaging—scenario when the person held a high-level position.
2. Money. Selling access to a criminal organization or selling information: customer databases, business proposals, strategic data. Sometimes for surprisingly low amounts.
3. Industrial espionage. In manufacturing plants and maquiladoras, there is also a physical risk: a temporary worker using glasses or a cell phone to record production processes.
4. The theft of technical information: blueprints, production data, source code. Sectors such as energy, automotive, and aerospace are natural targets.
5. The one who leaves. The most common and mundane scenario: the salesperson or manager who, knowing they’re going to quit, copies proposals, customer databases, and templates. It’s almost second nature. And part of the company ends up in the hands of the competition.

Detecting Without Surveillance of Everyone: Decoys Instead of Suspicions

It's not about distrusting every employee, but rather about ensuring that abnormal behavior stands out on its own. A good system combines several layers:

• A baseline for normal behavior. Logs from the entire infrastructure are centralized, and actual activity is compared to expected activity. When a device deviates from the pattern, it is investigated. Most of the time, it is an undocumented change; the rest warrants attention.
• Decoys. Fake accounts, folders, documents, or spreadsheets with enticing names like “payments,” “payroll,” or “VIP clients.” No one has a legitimate reason to open them. If someone does, they’re either an overly curious administrator… or someone looking for something they shouldn’t be.
• Behavioral analysis. A user who normally opens ten files a day and suddenly downloads ten thousand in an hour triggers an alert. Machine learning also detects slow leaks—those that extract a small amount of information each week to go unnoticed.
• The basics, automated. Next-generation antivirus (EDR), managed monitoring, and a firewall handle common attacks, so the security team can focus on threats that try to appear legitimate.

The enemy might also pass the interview

In sensitive industries (manufacturing, energy, finance, development centers), the focus has shifted to recruitment. Cases of fake “IT workers” have already been publicly documented: real but stolen identities, AI-enhanced photos, and seemingly flawless video interviews. The day they receive their equipment, they begin installing malicious software or operating from another country.

A few simple steps can greatly reduce the risk:

• At least one interview with the camera on and live identity verification.
• Deployment of devices with minimal privileges during the first few weeks.
• Watch for technical indicators: connections from unexpected locations, remote access tools, and keyboard behavior that does not match that of a person sitting at the computer.

Trust and control are not opposites

The difficult question is how to monitor without breaking trust. The answer lies in striking a balance: trusting people, but designing systems based on a Zero Trust approach, where no one has more access than they need and every access attempt is verified. No one is considered suspicious from the outset; it’s simply that anyone who snoops where they shouldn’t eventually gets caught.

Three practices account for a large part of the work:

1. Least privilege: Each person has access only to what their position requires, and this access is reviewed periodically.
2. Tightly Controlled Data Deletion: Access is revoked on the same day someone leaves the company. We explain what to do when a former employee requests that their data be deleted.
3. Clear and well-known rules: Monitoring must be disclosed in the privacy notice and in the internal regulations, and it is important to remind employees of the legal consequences of stealing information. Raising awareness is more of a deterrent than a preventative measure, but it does act as a deterrent.

Quick Checklist for Your Business

• Can you find out today who downloaded an unusually large number of files last week?
• Are the devices used from home corporate and managed?
• How long does it take to revoke all access privileges for someone who resigns?
• Do you have any kind of alarm that lets you know if someone is trespassing?
• Do your new IT hires start with limited privileges?

If you answered "no" to two or more, that's your starting point.

Where to Start

There’s no need to turn your company into a paranoid fortress. You need to know who has access to what and be able to spot when something is out of the ordinary. An IT audit documents this, and our 15 typical findings in subsidiaries show what usually comes up. For ongoing protection, learn about our cybersecurity service for businesses in Mexico.

Want to know if you'd be able to detect an internal leak today? Write to us, and we'll go over it with you.

This article is for informational purposes only and does not constitute legal advice.

Conceived by us. Created by us. Powered by AI.