Over the last year, an organization’s HR department has accessed data from its legal department...

A “malicious insider” is someone within the organization who has authorized access but intentionally misuses that access to extract or exfiltrate data. In this case:

The HR user has legitimate access but deviates from their normal behavior pattern (accessing legal data daily instead of monthly).

The presence of large data dumps and the alert from a threat intelligence platform suggest intentional misuse rather than accidental behavior.

According to the Cisco CyberOps Associate guide, insider threats are identified by behavioral anomalies, especially involving sensitive data access patterns inconsistent with role-based access and historical usage profiles.