APAC organisations face heavier insider incident pressure, Mimecast says

Organisations in Asia Pacific are dealing with insider-driven cyber incidents more often than their peers in North America and Europe, according to Mimecast’s State of Human Risk 2026 study. The finding points less to a difference in the cost of each incident and more to the operational strain created when these events happen repeatedly.

Mimecast said APAC organisations face an average of around eight insider-driven incidents involving data exposure, loss, leaks or theft each month. That compares with about six incidents in Europe, the Middle East and Africa, and five in North America. With the average cost per incident sitting at around US$13.1 million across regions, the gap in frequency makes APAC’s risk profile harder to manage over time.

Frequency is the main pressure point

The study frames insider-driven incidents as a persistent business risk tied to human behaviour rather than a set of isolated events. These incidents can stem from compromised credentials, negligent actions or inadvertent mistakes by employees, which means the issue is spread across everyday operations rather than limited to a narrow technical failure.

That distinction matters because the pressure builds cumulatively. If the financial cost of each incident is broadly similar across regions, then the higher volume in APAC puts more weight on incident response teams, governance structures and day-to-day security operations. The issue is not only whether an organisation can absorb a single incident, but whether it can keep responding to repeated exposures without wider disruption.

Mimecast said this pattern is becoming a defining risk factor for organisations operating at scale in the region. The figures suggest that the challenge in APAC is not an outlier event but a steady level of internal exposure that can create recurring operational drag.

Why APAC stands out

Mimecast links the higher frequency in APAC to the complexity of modern working environments. According to the research, organisations in the region are operating with large workforces, distributed teams and high volumes of daily communication and data exchange. That raises the number of points where insider-driven exposure can occur, whether through error, weak controls or compromised access.

The study also found that 64% of APAC respondents expect insider-driven data loss to increase at their organisation over the next 12 months. That result suggests concern that existing controls may not be keeping pace with how people work across digital systems, especially when communication, collaboration and data movement are spread across many teams and channels.

Mimecast argues that insider risk is being shaped less by single points of failure and more by the interaction between people, processes and visibility across systems. In practice, that means the issue is harder to reduce to a simple technology gap. It sits across behaviour, policy, oversight and the design of digital workflows.

Nicky Choo, Vice President and General Manager, APAC, Mimecast, said the difference in APAC is not the severity of each individual incident but the regularity with which they occur. “What differentiates APAC is not that insider-driven incidents are more costly than elsewhere, but that they are happening more often,” said Choo. “When organisations are dealing with insider incidents on a recurring basis, the cumulative impact on operations, customer trust and regulatory exposure becomes significant. This reinforces that human-driven cyber risk is not an abstract problem, it is an ongoing business challenge for organisations across the region.”

Detection efforts are increasing

The report also indicates that APAC organisations are already trying to build stronger visibility around this risk. More than half of respondents in the region, 53%, said they are using AI-driven behavioural or sentiment analysis to identify potential insider threats.

That figure suggests organisations are moving towards monitoring patterns of behaviour rather than relying only on conventional perimeter controls or post-incident investigation. It also shows that insider risk is being treated as something that needs ongoing detection, not just policy enforcement after the fact.

Even so, the study stops short of suggesting that these measures have solved the problem. If incident frequency remains higher in APAC and most respondents expect insider-driven data loss to rise further, then the adoption of AI-based monitoring appears to reflect a growing need for better detection rather than a settled answer.

The report’s broader implication is that insider risk is now being treated as part of cyber resilience rather than as a separate compliance or employee conduct issue. For security leaders, that shifts the discussion towards how organisations manage repeated human-linked exposure across normal business activity.

A resilience issue, not a one-off threat

Mimecast’s findings point to a cyber risk environment where internal exposure is part of routine operations. The concern for APAC organisations is not simply the headline cost of a breach, but the way repeated incidents can stretch teams, slow response processes and increase scrutiny over time.

The company said APAC’s elevated incident frequency can lead to greater regulatory exposure, prolonged disruption and erosion of stakeholder confidence. That makes insider-driven risk a governance and operational issue as much as a security one, especially for larger organisations handling high volumes of data and communication across dispersed teams.

The research is based on responses from IT and security decision-makers across APAC, North America and EMEA, and examines how human behaviour, insider activity and organisational practices are shaping cyber risk. Mimecast said the findings underline the need for organisations to manage insider risk as a core part of overall cyber resilience.