Security 1 publisher2 min readPublished September 10, 2026 at 7:43 AM PDT

CISA adds AI deception and adverse separations to the insider threat guide it wrote in 2020

The September 9 revision updates CISA's 2020 text on its own timeline, with no deadline attached and no incident behind it, and the topics CISA chose to add read as a checklist of the assumptions most insider threat programs have not revisited.

The Watch · Security desk

Illustration accompanying CISA adds AI deception and adverse separations to the insider threat guide it wrote in 2020

What happened

CISA published a revised Insider Threat Mitigation Guide on September 9, replacing the version it first issued in 2020.
The revision adds case studies, statistics and new guidance on hybrid and remote work, artificial intelligence and adverse employee separations.
The workplace material addresses the rise in hybrid and remote work and how each arrangement changes an organization's control over physical and digital access.
Scott Breor, CISA's acting executive assistant director for infrastructure security, said partner feedback informed the update and encouraged organizations to assess their own programs against it.

Compiled by The WatchSomething wrong?How this is made

Why it matters

decision The added topics set the order of a re-audit: access control for staff who are rarely on site, deception aimed at employees, and offboarding when the exit is not the employee's choice.
constraint A program scoped to data-loss alerting no longer matches the federal reference, which is filed under physical security and treats violence prevention as an insider threat outcome.
cost The bill is analyst and HR reading time plus re-pointing internal policy at a reorganized document, not change windows or downtime.
precedent With no revision schedule published and the 2020 edition having stood until now, programs should expect to be measured against this text for years rather than months.

The guide revision changed the baseline a program gets audited against on September 9, not the technical exposure of any organization ^[2]. CISA names the audience as the security and human resources staff who run insider threat programs plus leaders at any level, and says any organization can use the guide regardless of the maturity of its security ^[11].

The AI material is narrower than the label suggests. CISA describes it as covering AI used to manipulate or deceive, and the account is explicit that this is not a broader assessment of the technology's role in insider incidents ^[5]. Insider misuse of AI tools by employees is outside the scope described ^[16]. The agency says the update acknowledges the growing impact of insider threats on critical infrastructure and adds use cases to match how operations are changing ^[12], but none of the added statistics appear in the public account, so there is no figure here to benchmark a program against ^[15].

Where the guide sits carries as much weight as the new sections. It is filed in CISA's physical security section, next to the added access control and visitor screening content ^[8]^[6], and Scott Breor, CISA's acting executive assistant director for infrastructure security, put the purpose of a program as protecting key assets, preventing violence, reducing losses, safeguarding sensitive data and saving lives ^[7]. That is a wider remit than data loss. It decides who has to be in the room for the re-audit.

One mechanical detail matters for anyone mapping controls. The revision arrives in a streamlined format with sections consolidated ^[3], so internal policy that cites the 2020 guide by section will no longer land on the same text ^[14]. Organizations with no program at all are pointed first at newly released CISA resources on preparedness and early risk detection, which the agency frames as the practical route into the material ^[13]. CISA gave no timetable for further revisions ^[10]. The 2020 edition held until this one replaced it ^[2].

What to watch

Whether CISA publishes the statistics behind its critical infrastructure claim in a form programs can benchmark against.
Whether the AI section is later extended past manipulation and deception to insider use of AI tools.
Any published timetable for the next revision, which CISA has not given.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
CISA updated its Insider Threat Mitigation Guide with new case studies, statistics and guidance on hybrid and remote work, artificial intelligence and adverse employee separations.
ReportedSupportedView cited source
[2]
CISA published the revision on September 9; the guide was first issued in 2020.
ReportedSupportedView cited source
[3]
CISA said the guide arrives in a more streamlined format, with sections consolidated.
ReportedSupportedView cited source
[4]
The guide expands on emerging workplace trends, chiefly the rise in hybrid and remote work, and how each changes an organization's control over physical and digital access.
ReportedSupportedView cited source
[5]
CISA said the new AI material covers AI used to manipulate or deceive, rather than any broader assessment of the technology's role in insider incidents.
ReportedSupportedView cited source
[6]
CISA added content on access control, visitor screening and mitigating the risk of adverse employee separations.
ReportedSupportedView cited source
[7]
Scott Breor, CISA's acting executive assistant director for infrastructure security, said "Insider threats continue to evolve as technology becomes more advanced" and urged organizations to build a program that "protects key assets, prevent violence, reduce losses, safeguard sensitive data, and save lives."
ReportedSupportedSource: Scott Breor, CISA acting executive assistant director for infrastructure securityView cited source
[8]
The guide sits in CISA's physical security section alongside new material on access control and visitor screening, and CISA's framing is broader than data loss.
ReportedSupportedView cited source
[9]
Breor said industry and government partner feedback informed the update, and encouraged organizations to review the guide and assess their own programs against it.
ReportedSupportedSource: Scott Breor, CISAView cited source
[10]
CISA gave no timetable for further revisions of the guide.
ReportedSupportedView cited source
[11]
The guide supports security and human resources professionals who run insider threat programs, along with leaders at any level, and CISA said any organization can use it regardless of the maturity of its security.
ReportedSupportedView cited source
[12]
CISA said the update acknowledges the growing impact of insider threats on critical infrastructure and adds use cases for what it called a dynamic and evolving operational landscape.
ReportedSupportedView cited source
[13]
The guide is intended to give employees an understanding of behavioral indicators that may signal risk, and points to newly released CISA resources supporting preparedness and early risk detection, which the agency framed as the practical route into the material for organizations without an existing program.
ReportedSupportedView cited source
[14]
Because sections were consolidated in the new format, internal policy that cites the 2020 guide by section will not point at the same content.
DerivedSupported1 source— sign in to open
[15]
The public account of the revision carries no figure from the statistics CISA says it added, so its claim of growing impact on critical infrastructure is unquantified for readers.
DerivedSupported1 source— sign in to open
[16]
Insider misuse of AI tools by employees is outside the scope CISA describes for the guide's AI material.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

infosecurity-magazine.com
1 article · September 10, 2026
CISA Updates Insider Threat Guide With New Mitigation Advice

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Infosecurity Magazine is upfront that there is little here to wire up. The one detail that bears on tooling is the boundary CISA drew around its AI material: manipulation and deception aimed at the organization, not employees pushing sensitive data into chatbots. If you maintain detection content or access-review automation, the list of additions works as a coverage checklist for hybrid access, visitor screening and separations, and not as a specification.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence52

0100

Agency's own account, relayed once

The September 9 date, the consolidated sections, the scope of the AI material and the audience all come from CISA describing a document it wrote, passed through Infosecurity Magazine. The guide is public, so each of these is checkable in principle; within our coverage none of it has been checked, and the only line not sourced to CISA is the observation about where the guide sits in the agency's physical security section.

AdoptionInsufficient

Publication is the only datapoint

A guide being posted says nothing about who reads it. There is no download figure, no count of organizations running insider threat programs, and no indication of how widely the 2020 edition was used across the six years it stood, so any uptake number would be invented.

Hype gap+14

−100 understated0 aligned+100 overstated

Agency's language stretches further than the reporting

CISA says insider threats have a growing impact on critical infrastructure and says it added statistics, yet no number from those statistics reaches the reader, and Breor's stated aims run as far as saving lives. Infosecurity Magazine reports that language flatly and attaches no incident and no deadline to the revision, which keeps the gap narrow: the reach belongs to the agency's phrasing rather than to the coverage of it.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
Akira advisory update: $244m taken, one SonicWall CVE, three controls to audit now
1 publisher
leadership
The 100-firm cyber defense letter sets metrics for everyone but its own signatories
4 publishers
security
CISA and the FBI put "exceptionally risky" software practices in writing, and buyers get the list
1 publisher
security
CISA ran the same tradecraft at two organisations; only the water utility caught it
5 publishers

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources