--- title: "Mistakes, not thieves, cost US$10.3m of a US$19.5m insider-risk bill" summary: "What the 2026 Ponemon study of 354 organisations found about who causes insider data loss, and what it means for buying DLP in India, as of September 2026." url: https://www.thetechbag.com/blog/hidden-risks-data-exposure-every-needs-data format: Note desk: "Data & privacy" published: 2026-07-15 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["DLP","insider risk","data exposure","Ponemon","DTEX","DPDP","CERT-In","Seclore","Data Resolve","Seqrite","Safetica"] cover: https://www.thetechbag.com/blog/covers/hidden-risks-data-exposure-every-needs-data.png --- # Mistakes, not thieves, cost US$10.3m of a US$19.5m insider-risk bill *What the 2026 Ponemon study of 354 organisations found about who causes insider data loss, and what it means for buying DLP in India, as of September 2026.* Note · Data & privacy · By TechBag · Published 2026-07-15 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/hidden-risks-data-exposure-every-needs-data Negligence, not theft, is most of the bill. In the 2026 edition of the Ponemon Institute’s study for DTEX, organisations lost an average of US$19.5 million a year to insider incidents, and US$10.3 million of it came from employees’ mistakes and carelessness. Malicious insiders cost US$4.7 million; staff who were tricked, phished or had credentials taken cost US$4.5 million.[1][2] Our 2024 post said every business needs data loss prevention because data exposure is costly. The more useful question is which exposure a DLP product actually stops, and whether that is the one costing you money. ## Where the insider bill comes from **Figure: Mistakes cost more than the malicious and the tricked combined** *Average annual cost of insider incidents per organisation, by type of insider, US$ million, survey year to September 2025* - Negligent or mistaken insider10.3 US$ m 53% - Malicious insider4.7 US$ m 24% - Outsmarted insider (phished, credentials taken)4.5 US$ m 23% | | Value (US$ m) | Share | | --- | --- | --- | | Negligent or mistaken insider | 10.3 | 53% | | Malicious insider | 4.7 | 24% | | Outsmarted insider (phished, credentials taken) | 4.5 | 23% | Source: Ponemon Institute for DTEX, 2026 Cost of Insider Risks Global Report, as reported by DTEX and Infosecurity Magazine · as of 24 February 2026 · 354 organisations with 500 or more staff, none named as Indian The study surveyed 8,750 IT and security practitioners at 354 organisations in North America, Europe, the Middle East, Africa and Asia-Pacific that had at least one material insider event. They averaged 25.4 incidents a year and took 67 days to contain one, down from 86 in 2023.[1] The sample is large firms, and it does not break out India; treat the shares, not the dollar totals, as the transferable finding. ## What that means for a DLP purchase DLP is at its best against the largest slice, the mistakes. A content rule that catches a spreadsheet of customer records addressed to the wrong person, or uploaded to a personal drive, stops a mistake at the moment it happens; the products that coach the user instead of only blocking aim squarely at it.[3] Against a determined insider it is a speed bump that produces evidence, and against the third slice it is the wrong tool: a phished employee is an email-security and identity problem. Our view Our view: not every business needs a standalone DLP product, but every business that holds personal data needs the control. Start with what you own, then buy where the mistakes happen. If most of your data lives in email and one cloud suite, the suite’s own controls come first; buy an endpoint DLP agent when files leave through laptops, USB and personal cloud. For which products watch which exit, see [our count of 18 DLP products by channel](https://www.thetechbag.com/blog/dont-be-data-dribbler-unpack-data-loss). ## In India Three of the DLP vendors in TechBag’s guide are built here, Data Resolve, Seqrite and Seclore, and all three quote in rupees. Of the foreign products, Safetica publishes US$72 to US$144 a user a year and Forcepoint starts from about US$52; both are invoiced in INR through a reseller, with 18% GST on top.[3] The law sets the stakes: the DPDP Act’s schedule allows a penalty of up to ₹250 crore for failing to take reasonable security safeguards,[4] and the DPDP Rules, notified on 13 November 2025, bring that duty and breach intimation into force on 13 May 2027.[5] CERT-In’s Directions of 28 April 2022 already require a reportable incident to reach CERT-In within six hours.[6] How we did this Figures as of 30 September 2026 The insider-cost figures are the 2026 Cost of Insider Risks Global Report by the Ponemon Institute, sponsored by DTEX and released on 24 February 2026, taken from DTEX’s release and Infosecurity Magazine’s report of it; the full report was not read. The three insider types sum to the US$19.5 million total. Prices and India attributes are from TechBag’s DLP and insider risk guide as committed on 30 September 2026. No India-only insider-cost figure was found, so none is given. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [DTEX, 2026 Cost of Insider Risks Global Report press release (US$19.5m; 67 days; 25.4 incidents; 354 organisations)](https://finance.yahoo.com/news/insider-risk-costs-hit-19-170000656.html) — 24 February 2026 2. [Infosecurity Magazine, Cost of Insider Incidents Surges 20% to Nearly $20m (cost by insider type)](https://www.infosecurity-magazine.com/news/cost-of-insider-incidents-surges/) — 24 February 2026 3. [TechBag, DLP & insider risk decision guide (18 products, 14 vendors)](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — as committed 30 September 2026 4. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 5. [MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E)](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) — 13 November 2025 6. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [DLP & insider risk guide](https://www.thetechbag.com/browse/data-security-privacy/dlp-insider-risk) — 18 products across 14 vendors, with the three built in India - [Seclore vendor hub](https://www.thetechbag.com/seclore) — Mumbai-built DLP that hands the file to rights management instead of only blocking it