Insider threat models for payment platforms

The external threat model — an unknown attacker attacking a payment platform from outside — is the one every security review covers. The insider threat model gets less attention, in part because it's culturally uncomfortable, and in part because the mitigations are unglamorous.

Based on a set of security reviews 2023–2024; written May 2025.

The three insider profiles

• The privileged accidental. An engineer with database access runs a query in the wrong environment. No malice; a data exposure regardless.
• The compromised legitimate. A legitimate account whose credentials have been stolen. From the platform's perspective, this looks like a legitimate user with a suspicious pattern.
• The malicious insider. Rare but not zero. Usually involves exfiltrating data or standing up a persistent access mechanism.

The mitigations differ per profile.

What works

• Access minimisation. No production data access should be routine. Every access should be justified, logged, and time-bounded.
• Query audit trails. Every query against sensitive data should be recorded with attribution. This deters accidents and creates evidence for the small number of malicious cases.
• Segregation of duties. The person who deploys code should not be the person who accesses production data. This is basic and often violated on small teams.
• Behavioural monitoring on privileged accounts. Not just authentication; ongoing behavioural signals for accounts with data access.

What doesn't work

• Trust-based controls. "We trust our engineers" is not a control; it's a description of a culture. The controls have to exist independently.
• Point-in-time reviews. Access controls set at hiring and reviewed annually miss most of the drift. Continuous review is the discipline.

The uncomfortable part of insider threat is that the mitigations affect the people you work with. The alternative is worse.