Internal Threat

I've worked in information security for over three decades. I started at a time when the discipline didn't even have that name: we called it "computer security," and it essentially boiled down to antivirus software, passwords, and a firewall at the network's edge. The enemy was out there—a curious teenager, an opportunistic criminal, later an organized group or a state. Our mission was clear: build the highest possible wall and guard the gate.

It took me years to accept what I now consider the most uncomfortable truth of my profession: most of the serious damage I witnessed throughout my career didn't come from the outside. It came from within. It came from people with badges, valid credentials, and photos on the intranet. It came from the disillusioned administrator who took the keys to the kingdom with him, from the exemplary employee who clicked on the wrong connection on a mundane Tuesday, from the trusted supplier whose credentials were stolen without anyone noticing, from the technical staff who patiently copied things they shouldn't have for months. None of them had to "go in"—they were already there.

Technical literature has been slow to keep pace with this reality. For years, insider threats were treated as a footnote: a short chapter at the end of manuals, a slide in annual training sessions, a line in the risk matrix to which no one allocated a budget. Meanwhile, the numbers accumulated in the opposite direction. The benchmark annual reports—the same ones that the reader will find cited, scrutinized, and contextualized throughout this work—show, with stubborn consistency, that incidents originating from or involving internal human activity are among the most expensive, the slowest to detect, and the most devastating to the trust of customers, regulators, and markets. The external attacker steals data; the internal one also steals the certainty that we can trust our own people and our own processes. This second theft is the most difficult to repair.

It is in this context that the book the reader now holds in their hands emerges—and I say, without reservation, that it fills a real void in the bibliography in the Portuguese language, and not only that.

I am well acquainted with the "cybersecurity manual" genre. There are excellent works on cryptography, networks, incident response, and compliance. What was practically nonexistent was a work that addressed the insider threat for what it is: a total problem that permeates technology, psychology, law, management, and organizational culture—and which, therefore, cannot be solved by any of these disciplines in isolation. Hermínio Cerqueira understood this and had the rare ambition to write the entire book: from the historical foundations to the technical architecture, from the insider's mind to the letter of the regulation, from the Snowden case to the automated response playbook, from the principle of least privilege to a documented policy ready for adaptation.

Three qualities of this work deserve highlighting.

The first is intellectual honesty. This is not a fear-mongering book, nor a product catalog disguised as doctrine. The author rejects sensationalism with the same firmness with which he rejects comfort. When the data is solid, he cites its source; when it is uncertain or disputed—and in our field many numbers circulate for years without anyone verifying their origin—he states so openly. In a discipline saturated with orphaned statistics and marketing disguised as research, this methodological discipline is invaluable...