We found it during a PCI audit sweep. Scanning every system, as the audit required, we turned up a copy of L0phtCrack sitting on one of our servers. If you know the tool, you know the feeling: L0phtCrack is a password cracker, an unambiguous hacker utility, and it was inside our environment, on our hardware.
The first hours were pure panic response. A cracking tool on a server means someone put it there, and until you know who, you assume the worst: an intruder with a foothold, working your credential store while you hunt. We traced it down expecting a breach.
The call is coming from inside the house
The trail ended at one of our own consultants. He’d a job to do, the job required passwords, and we hadn’t given him passwords. Instead of asking for access, he installed a cracker and took it. And here’s the detail that matters: he succeeded. He got passwords. He got in. The tool worked exactly as designed, wielded by someone we’d invited into the building.
He wasn’t malicious. He was trying to do his job and chose the wrong path. It didn’t matter. We called him in, and he was let go immediately. Cracking credentials on a corporate network isn’t a judgment call, whatever the intent behind it. The act is the offense.
That firing taught the organization something no policy memo could: the rules bind everyone, including the people we hired for their expertise, including people whose motives were arguably clean. If intent excused the act, every attacker caught mid-breach would claim good intentions, and some of the most damaging insiders have them.
The other flavor
Insider threats don’t all look like an impatient consultant. At another company I worked with, a colleague in my group uncovered an employee cooking the books, systematic financial fraud from inside the organization. That one ended in prosecution and jail. At a third company, we discovered illegal pornography on an employee’s system; he was fired and the police were called in.
Three insiders, three motives: expedience, greed, and criminality. What they share is the thing perimeter security can’t address. Every one of them was already inside. Firewalls face outward. The consultant had legitimate access to the building, the fraudster had legitimate access to the ledgers, and no amount of perimeter hardening would have touched either.
An engineer cracked our passwords because asking felt slower. In security, good intent doesn’t excuse the act.Share on X
Why do you never hear insider threat stories?
Notice that you’ve read plenty about external breaches and almost nothing about incidents like these, and the silence is structural. Companies disclose external attacks because attackers are a shared enemy and victimhood is forgivable. Insider incidents implicate the company itself: its hiring, its oversight, its controls. The fraud case ended in prosecution, which is public record, but the consultant and the pornography case ended the way most insider incidents end, in quiet terminations that never touch a press release.
Multiply that silence across every company, and the industry’s picture of its own threat landscape is systematically distorted toward the outside.
The distortion has a budget consequence. Security spending follows the visible threat, so it flows overwhelmingly toward the perimeter, while the controls that actually caught our three insiders, comprehensive scanning, financial oversight, verification applied uniformly, get funded as compliance afterthoughts. I’m not arguing the perimeter is overfunded. I’m observing that the threat you never read about isn’t the threat you don’t have.
What catches insider threats?
Notice what found each one. The consultant was caught by a comprehensive scan, an audit control that inventoried every system without exceptions for systems presumed clean. The fraud was caught by financial oversight, the segregation-of-duties territory I cover in a companion article on documenting roles, not just rules. None were caught by trust, and none would have been caught by tools pointed at the internet.
The uncomfortable summary: insider defense is mostly verification applied to people you’ve already decided to trust. It feels rude. It works anyway. And for executives who publish on security, the insider chapter is the one your readers won’t get anywhere else, because companies bury these stories, and that’s why a candid, anonymized telling carries so much authority.
For more from this series, see The Cybersecurity Hub: breaches, audits, and hard-won security lessons from four decades in the trenches.
