Data & privacyNote
Mistakes, not thieves, cost US$10.3m of a US$19.5m insider-risk bill
What the 2026 Ponemon study of 354 organisations found about who causes insider data loss, and what it means for buying DLP in India, as of September 2026.
Negligence, not theft, is most of the bill. In the 2026 edition of the Ponemon Institute’s study for DTEX, organisations lost an average of US$19.5 million a year to insider incidents, and US$10.3 million of it came from employees’ mistakes and carelessness. Malicious insiders cost US$4.7 million; staff who were tricked, phished or had credentials taken cost US$4.5 million.12 Our 2024 post said every business needs data loss prevention because data exposure is costly. The more useful question is which exposure a DLP product actually stops, and whether that is the one costing you money.
01Where the insider bill comes from
Mistakes cost more than the malicious and the tricked combined
Average annual cost of insider incidents per organisation, by type of insider, US$ million, survey year to September 2025
- Negligent or mistaken insider10.3 US$ m 53%
- Malicious insider4.7 US$ m 24%
- Outsmarted insider (phished, credentials taken)4.5 US$ m 23%
Table view
| Value (US$ m) | Share | |
|---|---|---|
| Negligent or mistaken insider | 10.3 | 53% |
| Malicious insider | 4.7 | 24% |
| Outsmarted insider (phished, credentials taken) | 4.5 | 23% |
Source: Ponemon Institute for DTEX, 2026 Cost of Insider Risks Global Report, as reported by DTEX and Infosecurity Magazine · as of 24 February 2026 · 354 organisations with 500 or more staff, none named as Indian
The study surveyed 8,750 IT and security practitioners at 354 organisations in North America, Europe, the Middle East, Africa and Asia-Pacific that had at least one material insider event. They averaged 25.4 incidents a year and took 67 days to contain one, down from 86 in 2023.1 The sample is large firms, and it does not break out India; treat the shares, not the dollar totals, as the transferable finding.
02What that means for a DLP purchase
DLP is at its best against the largest slice, the mistakes. A content rule that catches a spreadsheet of customer records addressed to the wrong person, or uploaded to a personal drive, stops a mistake at the moment it happens; the products that coach the user instead of only blocking aim squarely at it.3 Against a determined insider it is a speed bump that produces evidence, and against the third slice it is the wrong tool: a phished employee is an email-security and identity problem.
For which products watch which exit, see our count of 18 DLP products by channel.
03In India
Three of the DLP vendors in TechBag’s guide are built here, Data Resolve, Seqrite and Seclore, and all three quote in rupees. Of the foreign products, Safetica publishes US$72 to US$144 a user a year and Forcepoint starts from about US$52; both are invoiced in INR through a reseller, with 18% GST on top.3 The law sets the stakes: the DPDP Act’s schedule allows a penalty of up to ₹250 crore for failing to take reasonable security safeguards,4 and the DPDP Rules, notified on 13 November 2025, bring that duty and breach intimation into force on 13 May 2027.5 CERT-In’s Directions of 28 April 2022 already require a reportable incident to reach CERT-In within six hours.6
Sources
- DTEX, 2026 Cost of Insider Risks Global Report press release (US$19.5m; 67 days; 25.4 incidents; 354 organisations) — 24 February 2026
- Infosecurity Magazine, Cost of Insider Incidents Surges 20% to Nearly $20m (cost by insider type) — 24 February 2026
- TechBag, DLP & insider risk decision guide (18 products, 14 vendors) — as committed 30 September 2026
- Digital Personal Data Protection Act, 2023, Schedule (penalties) — 11 August 2023
- MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) — 13 November 2025
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting) — 28 April 2022
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
