8.1 Shadow Projection onto Attackers

What it is

Shadow projection occurs when organizations unconsciously focus all security concerns on external 'bad actors' while idealizing internal employees and trusted partners as inherently safe. This psychological blind spot leads to systematic underinvestment in insider threat detection and creates vulnerabilities that sophisticated attackers routinely exploit.

Why it happens

Jung (1969) identified the shadow as containing both personal and collective unconscious contents that the ego refuses to acknowledge. Klein's (1946) work on splitting demonstrates how anxiety-provoking objects are divided into 'all good' and 'all bad' categories. Bion's (1961) research shows how groups project internal anxieties onto external threats (fight-flight assumption), leading to aggressive defensive postures that neglect internal vulnerabilities.

How it is assessed

A quick assessment asks these questions; each answer is scored from resilient to exposed.

Security Budget Allocation: Internal vs. External Threats
What percentage of your annual cybersecurity budget is specifically allocated to insider threat detection, employee behavior monitoring, and privileged access oversight versus external threat prevention (firewalls, endpoint protection, threat intelligence)?
Alert Investigation Priority: Internal vs. External
When your security team receives alerts, how quickly do you typically investigate suspicious activity from internal users compared to external threats?
Privileged Access Review Frequency and Rigor
How often do you conduct comprehensive reviews of employee access rights, and what's your process for investigating employees who access unusual systems or data?
Trusted Vendor and Partner Security Oversight
What specific security controls do you require from trusted vendors and business partners, and how do you monitor their access to your systems?
Post-Incident Analysis Focus: Internal vs. External Factors
When you experience a security incident, what percentage of your investigation focuses on internal factors (employee behavior, process failures, access controls) versus external attacker capabilities?
Security Awareness Training Content Balance
What percentage of your security training and communications focuses on insider threats, social engineering targeting employees, and internal security responsibilities versus external threats like hackers and malware?
Threat Intelligence Source Balance
What sources do you use for threat intelligence, and how much of your threat intelligence specifically addresses insider threats, social engineering techniques, and supply chain risks versus external attack methods?

Reading the result

Resilient

Organization maintains balanced investment in both internal and external threat detection, with 30%+ of security budget allocated to insider threat programs. Equal priority given to investigating internal and external threats. Regular access reviews with documented findings. Formal vendor security assessment with ongoing monitoring.

Partly exposed

Organization shows moderate external focus with 15-30% of security budget for insider threats. Some delay in investigating internal versus external alerts. Semi-annual access reviews with limited follow-up. Basic vendor security requirements without ongoing monitoring.

Exposed

Organization exhibits heavy shadow projection with less than 15% of security budget allocated to insider threat detection. Significant delays or lower priority for internal threat investigation. Annual or ad-hoc access reviews. Minimal vendor security oversight. Post-incident analysis focuses primarily on external attacker sophistication.

What to change

Insider Threat Analytics Platform

Deploy user behavior analytics (UBA) tools that monitor employee access patterns, data movement, and system usage for anomalies

Implement automated alerts for unusual access times, large data downloads, access to sensitive systems by users without business need, and attempts to access systems outside normal job functions. Baseline normal behavior over 30-60 days, then enable alerting with tiered response workflows.

Effort: high | Time to put in place: 60-90 days for deployment and baseline establishment

Privileged Access Management (PAM) with Behavioral Monitoring

Implement comprehensive PAM solutions requiring approval workflows for elevated access with session recording for administrative activities

Deploy PAM platform with just-in-time access provisioning to minimize standing privileges. Implement session recording for all privileged access. Establish approval workflows with business justification requirements. Automatically de-provision access based on role changes. Maintain detailed audit logs with regular review cycles.

Effort: high | Time to put in place: 60-90 days for enterprise deployment

Vendor Risk Management Program with Ongoing Monitoring

Establish formal vendor security assessment processes with ongoing monitoring of vendor access to organizational systems

Implement security questionnaires and penetration testing requirements for critical vendors. Deploy continuous security monitoring of vendor access. Conduct regular security reviews (quarterly for critical vendors). Establish incident notification requirements. Implement network segmentation for vendor connections with micro-segmentation for high-risk access.

Effort: medium | Time to put in place: 45-60 days for program establishment

Balanced Security Awareness Training Program

Develop security training that addresses insider threats, internal responsibilities, and social engineering targeting employees with equal emphasis to external threats

Restructure training curriculum to allocate 40%+ content to insider risk scenarios. Deploy targeted phishing simulations including insider impersonation scenarios (fake executive emails, fake IT support, fake vendor requests). Provide personalized training based on simulation results. Include executive-level awareness of CEO fraud and business email compromise. Track improvement metrics and adjust training based on results.

Effort: low | Time to put in place: 30 days to restructure curriculum, ongoing delivery

Integrated Threat Intelligence Program

Implement threat intelligence programs that include insider threat indicators, social engineering campaigns, and supply chain risk intelligence alongside external threat feeds

Subscribe to insider threat intelligence feeds (industry-specific employee risk indicators, social engineering campaign tracking). Integrate supply chain compromise indicators relevant to organizational vendors. Subscribe to behavioral indicators of potential insider threats (credential misuse patterns, data exfiltration techniques). Integrate all intelligence sources into security monitoring and incident response procedures with contextualized alerting.

Effort: medium | Time to put in place: 30-45 days for integration

Zero Trust Architecture Implementation

Deploy zero trust principles that verify every user and device regardless of location, eliminating implicit trust for insiders

Implement continuous verification for all users and devices regardless of network location. Deploy micro-segmentation to limit lateral movement. Require multi-factor authentication for all access (not just external). Continuously monitor all network traffic and user behavior with behavioral baselines. Automatically adjust access permissions based on real-time risk assessment. Eliminate VPN 'trusted network' assumptions.

Shadow Projection onto Attackers