Pretty much any security training will identify insiders, malicious or not, as a vector. That's the whole point behind phishing attacks against corporate emplo

Pretty much any security training will identify insiders, malicious or not, as a vector. That's the whole point behind phishing attacks against corporate employees. Back in the day of windows auto-playing CDs and USB files, dropping random official looking drives around the parking lot was a thing: https://www.wired.com/2011/06/the-dropped-drive-hack/ https://www.wired.com/2011/06/the-dropped-drive-hack/ Then you get into data exfiltration by employees who were bribed, etc.