Insider Threats: When the Person Already Has a Badge

By Churchgate Protective | September 9, 2026

An insider threat comes from someone who already has—or previously had—legitimate access to a workplace. Reducing the risk requires more than locked doors. NYC businesses need controlled badge permissions, fast offboarding, trained security personnel, confidential employee reporting, clear escalation procedures, and cooperation between management, human resources, IT, and security.

The hardest person to stop may not be a stranger trying to force open the door.

It may be someone who already has a badge.

Employees, former employees, contractors, vendors, temporary workers, and business partners may know the building’s entrances, schedules, restricted areas, and security routines. Most are trustworthy. However, one misused credential, shared badge, or delayed access cancellation can create a serious security gap.

The goal is not to distrust everyone. It is to make sure trusted access remains appropriate, monitored, and removable.

What Is an Insider Threat?

An insider threat is a security risk involving someone who has legitimate knowledge of or access to an organisation’s people, property, systems, or restricted areas.

The person may be:

A current employee
A former employee
A contractor or temporary worker
A delivery or service provider
A vendor
A business partner
Someone using another person’s credentials
Someone whose valid account or badge has been compromised

Insider incidents are not always intentional. They can result from carelessness, policy violations, shared credentials, poor offboarding, or a person being manipulated by someone outside the organisation.

Examples include:

An employee allowing an unauthorised person through a secure entrance
A former employee using a badge that was never disabled
A contractor entering an area outside the approved work zone
A worker copying confidential information
An employee stealing equipment, products, keys, or access cards
Someone using their authorised access to prepare for theft or violence
An employee ignoring a propped security door
A worker lending a badge to another person

Cybersecurity teams often discuss insider threats in relation to data. But the same idea applies to physical security: a person with trusted access can bypass controls designed to stop outsiders.

What Does the 94% Insider-Access Finding Mean?

In July 2026, the Violence Prevention Project released new homicide databases covering workplace, medical, and higher-education settings.

Its Workplace Homicide Database includes 653 incidents from 2000 through 2025 in which the perpetrator was a current or former employee.

According to an analysis published by Security Management and ASIS International, the perpetrator entered using existing credentials in 94% of the workplace insider homicides studied.

That statistic needs context.

It does not mean insiders commit 94% of all workplace violence. The finding applies to the specific insider-homicide cases in the database. Many workplace crimes are still committed by customers, strangers, robbers, or other outsiders.

The finding shows why perimeter security alone is not enough. A locked entrance provides limited protection when the person already has authorised access—or when access was not removed after employment ended.

Why Insider Threats Are Difficult to Detect

An outsider may attract attention because they do not know the property or its procedures.

An insider often does.

They may know:

Which doors receive less supervision
When guards change shifts
Where CCTV cameras are positioned
Which entrances are commonly propped open
When managers arrive and leave
Where valuable equipment or information is stored
How visitors and contractors are approved
Which employees are likely to hold a door open
How quickly an alarm receives a response

Normal access can also hide unusual activity. A valid badge swipe may appear legitimate even when the person has no business entering that area at that time.

That is why a useful security program must evaluate the context surrounding the access—not only whether the badge worked.

A Badge Should Not Provide Unlimited Trust

An access badge should allow a person to enter only the locations necessary for their role and only during appropriate hours.

This is commonly called role-based access.

For example:

A daytime office employee may not need overnight access.
A cleaning contractor may need access only during scheduled service hours.
A retail employee may need access to the staff entrance but not the cash office.
A construction subcontractor may need access to one floor instead of the entire building.
A former employee should lose access as soon as the authorised employment relationship ends.

When every badge opens every door, the badge system provides convenience but limited protection.

Warning Signs That Require Attention

One action does not automatically make someone a threat. Security decisions should be based on facts, patterns, and credible information—not rumours, personal bias, or assumptions about someone’s appearance or mental health.

However, certain behaviours may require review:

Repeated attempts to enter unauthorised areas
Badge use at unusual times without a clear business reason
Sharing, borrowing, or copying access credentials
Allowing unknown people to enter behind them
Photographing restricted rooms or security equipment without approval
Repeatedly bypassing visitor procedures
Threatening communication or fixation on a workplace grievance
Attempts to obtain keys, codes, records, or access beyond the person’s role
Returning to the workplace after access has been withdrawn
Testing doors, alarms, or security responses
Unexplained interest in employee schedules or emergency procedures

Employees should know where to report concerns. Reports should be reviewed by trained people who can separate misunderstandings from genuine risk.

What NYC Businesses Can Do to Reduce Insider Risk

1. Review badge permissions regularly

Do not wait for an incident to discover that old badges still work.

Conduct regular access reviews to identify:

Former employees with active credentials
Expired contractors
Lost or unreturned badges
Duplicate credentials
Employees with unnecessary access
Badges being used outside approved hours
Credentials that have not been used for long periods

The review schedule should reflect the property’s risk. A high-traffic commercial building, retail operation, warehouse, healthcare facility, or construction site may require more frequent checks.

2. Disable access during offboarding

HR, management, IT, and security should follow the same offboarding checklist.

When employment or a contract ends, the process may need to include:

Disabling physical-access badges
Removing digital access
Collecting keys and identification cards
Changing shared door or alarm codes
Removing the person from visitor approval lists
Notifying reception and security
Recovering company equipment
Documenting the date and time access was removed

Timing matters. Access should not remain active simply because one department assumed another department had cancelled it.

3. Plan sensitive separations carefully

The July 2026 database analysis found that discipline, termination, and workplace conflict were important risk periods in the cases studied. Nearly one-quarter of workplace insider perpetrators had reportedly received a recent reprimand. Former employees were also responsible for a larger share of workplace active-shooter cases than insider homicides overall.

This does not mean every disciplinary meeting is dangerous. It means organisations should have a process for identifying situations that may require additional planning.

Depending on the circumstances, that plan could include:

Coordinating between HR, management, IT, and security
Selecting an appropriate meeting location and time
Disabling access at the correct moment
Arranging a safe collection of company property
Escorting the individual from the premises when appropriate
Protecting affected employees’ personal information and schedules
Monitoring attempted re-entry
Contacting law enforcement when there is a specific and immediate threat

Security decisions should be proportional to the facts—not automatic or punitive.

4. Stop badge sharing and tailgating

Access control can be defeated when one person swipes and several people enter.

Employees should be trained not to:

Lend their badges
Hold secure doors open for unknown people
Allow visitors to follow them into restricted areas
Ignore propped doors
Use another employee’s credentials

A simple and respectful verification process can prevent an uncomfortable situation from becoming a security failure.

5. Give employees a safe reporting channel

Employees often notice changes before management does. They may see repeated policy violations, hostile messages, attempts to enter restricted areas, or concerning behaviour.

A reporting process should be:

Easy to find
Confidential when possible
Available without fear of retaliation
Reviewed promptly
Managed by trained decision-makers
Connected to a clear escalation process

The ASIS analysis found that approximately half of the insider perpetrators in its workplace dataset showed warning signs, while fewer than one in ten made an explicit threat.

That distinction matters. Waiting only for someone to make a direct threat may cause an organisation to miss a wider pattern of concerning behaviour.

6. Connect access logs, CCTV, and incident reports

Each security system tells only part of the story.

An access log may show that a badge opened a door. CCTV may show who used it. An incident report may explain why the entry was unusual.

When these records are reviewed together, businesses may identify patterns such as:

One badge being used by different people
Repeated late-night entries
Access attempts after termination
Employees entering unrelated departments
Doors being held open after a valid swipe
Contractors moving outside their approved areas

Technology should help people make better decisions. It should not replace human review.

7. Create an escalation procedure

Employees and guards should not have to invent a response during an incident.

The procedure should explain:

Who receives the initial report
Who verifies the information
When HR, management, IT, or legal counsel becomes involved
When badge access should be suspended
When on-site security should intervene
When police or emergency services should be contacted
How the incident should be documented
Who follows up with affected employees

If there is an immediate threat to life or safety, call 911.

How Can an Unarmed Security Guard Help?

A trained unarmed security guard can provide the human judgment that an automated access system lacks.

Depending on the property and post orders, a guard may:

Verify employees, visitors, vendors, and contractors
Confirm that a badge belongs to the person using it
Prevent tailgating
Inspect propped or unsecured doors
Monitor access during opening and closing
Question unusual activity professionally
Enforce visitor and contractor procedures
Observe behaviour without making unsupported accusations
Document attempted or unauthorised access
Notify management of policy violations
Support planned offboarding procedures
Preserve relevant CCTV and incident information
Contact emergency services when required

A guard should not be expected to diagnose a person, conduct an HR investigation, or physically confront every suspected violation.

The guard’s responsibilities should be clearly stated in the site’s post orders and coordinated with management.

Learn more about Churchgate Protective Services’ security solutions for New York City properties.

Can Cameras Prevent Insider Threats?

Cameras are valuable for verification, investigation, and documentation. They may also discourage some misconduct.

But cameras have limitations.

A camera can record someone entering a restricted room. It cannot always determine whether the person had a legitimate business reason to be there. It cannot ask for identification, correct a propped door, assist an employee, or manage a developing confrontation.

The strongest approach combines:

Controlled access
Appropriate CCTV coverage
Clear workplace policies
Employee reporting
Trained guards
Management oversight
Fast incident escalation
Accurate documentation

Each layer supports the others.

NYC Insider-Threat Security Checklist

Use this checklist when reviewing a New York City workplace:

Are all active badges assigned to identifiable people?
Does each person have only the access needed for their role?
Are former employees’ credentials disabled immediately?
Are contractor badges limited by location and time?
Are visitors required to sign in and remain identifiable?
Are staff trained to prevent tailgating?
Are propped doors investigated and documented?
Can management compare badge activity with CCTV?
Is there a confidential reporting option?
Do employees know who receives safety concerns?
Is there a plan for sensitive terminations?
Are guards given current employee and access instructions?
Are incidents recorded with exact times, locations, actions, and notifications?
Is the response procedure tested before an emergency?

If several answers are “no,” the property may have an insider-risk gap.

Frequently Asked Questions

What is an insider threat in physical security?

An insider threat is a risk involving someone with legitimate or previous access to a workplace, such as an employee, former employee, contractor, vendor, or business partner.

Can an access badge stop an insider threat?

A badge can restrict and record access, but it cannot eliminate insider risk by itself. Permissions, offboarding, anti-tailgating procedures, monitoring, reporting, and human verification are still necessary.

What should happen to a badge when an employee leaves?

The badge should be disabled at the appropriate time during the offboarding process. Keys, identification cards, devices, and other credentials should also be collected or cancelled.

Should employees confront a coworker entering a restricted area?

Employees should follow the organisation’s reporting and escalation procedure. They should not place themselves at risk. A trained guard, supervisor, or manager can verify the situation.

What can a security guard do about insider threats?

An unarmed guard can verify identity, monitor access, prevent tailgating, document unusual activity, enforce property procedures, notify management, and request emergency assistance.

Does unusual behaviour prove that someone is dangerous?

No. A single behaviour should not be treated as proof. Concerns should be documented factually and reviewed by qualified personnel using established procedures.

Do small businesses need an insider-threat plan?

Small businesses may not need a large threat-management department, but they still need basic controls: individual credentials, immediate offboarding, visitor management, secure keys, incident reporting, and an emergency contact process.

Your Security Plan Must Protect the Inside Too

A front door, camera, or access badge is only one security layer.

If your property does not control who can enter each area, remove access quickly, document unusual activity, and respond to employee concerns, authorised access can become an unmonitored risk.

Churchgate Protective Services provides professional security coverage for commercial properties, retail locations, construction sites, residential buildings, and other organisations throughout New York City.

Explore our professional security services or contact Churchgate Protective to discuss your property’s access-control and security needs.

Churchgate Protective Services
747 Lexington Ave., Suite 1
Brooklyn, NY 11221
Phone: (718) 498-5960
Email: info@churchgatecorp.com

This article provides general security information. It is not legal, employment, mental-health, or law-enforcement advice. Businesses should consult qualified professionals when creating workplace-violence, employee-relations, or emergency-response policies.