Insider extortion is coercion that uses legitimate internal access to pressure an organization. The insider may be a current or former employee, contractor, or administrator who knows how systems are run and can reach privileged accounts, passwords, files, or recovery tools. Because the access is trusted, the activity can look like normal administration at first.
This matters because privileged access can be turned into leverage without malware or a complex intrusion chain. An insider may delete admin accounts, reset passwords, lock teams out of critical systems, or threaten to disrupt operations unless payment or concessions are made. Defenders reduce this risk with least-privilege access, separation of duties, strong logging, rapid offboarding, protected recovery accounts, and alerts for unusual changes to identities and authentication controls.