CalypsoAI Insider Threat Report 2025

Keypoints

• Annual cybersecurity reports typically include an introduction and overview, data collection methodology, detailed analysis of threat landscapes, sector-specific insights, and concluding recommendations.
• These reports present key statistics on threat prevalence, emerging attack techniques, user behavior, and organizational risk tolerance, with expert commentary on shifts in technology and defense strategies.
• The CalypsoAI report identifies widespread internal misuse of AI, with over half of employees willing to break policies for efficiency, and 28% admitting to using AI to access sensitive data.
• A significant trust transition is observed, where 45% of employees trust AI more than human coworkers and many would prefer AI managers, indicating AI’s rising role within workplace dynamics.
• C-suite leaders show a lack of AI comprehension, with 38% unaware of what an AI agent is, yet 67% willing to use AI despite policy constraints, posing organizational risks.
• Entry-level employees demonstrate confusion and disregard for AI policies, with substantial percentages indifferent to rules or unaware of AI agent concepts.
• Highly regulated industries such as financial services, healthcare, and security face distinct AI-related compliance challenges with widespread unauthorized AI use and varied trust in AI capabilities.
• In financial services and banking, 60% of employees use AI tools despite policy violations, reflecting a culture shift where trust in AI surpasses comprehension.
• Healthcare employees show low adherence to AI policies and underestimate AI security risks, despite handling sensitive data, raising concerns over data exposure.
• Security professionals admit to policy breaches involving AI, with a notable portion distrusting their IT teams’ ability to detect AI-caused data leaks.
• IT and Telecom workers are the most enthusiastic AI adopters, though many admit to policy violations and show high confidence in their understanding of AI agents’ risks.
• The report underscores recurring themes: the internal threat posed by uninformed AI use, the need for updated technical controls and compliance frameworks, and the necessity of education to foster a culture of AI risk awareness.
• Overall, the findings reflect a complex AI risk landscape where innovation drives adoption but outpaces understanding, requiring enterprises to evolve their security posture holistically.