When decision-makers hear the term “cybersecurity incident,” they usually imagine a hoodie-wearing hacker in a dark basement hacking into an important server using sophisticated methods that explore yet undiscovered vulnerabilities. In reality, most cybersecurity incidents are caused by insiders—both malicious and negligent.