An insider threat arises when current or former employees, contractors, or business associates, who have inside information concerning the organization's security practices, data, and computer systems, misuse their permissions, intentionally or unintentionally causing harm to the business. External threats come from outside the organization and wouldn't be considered insiders. Social engineering and physical risks may be associated with insider actions or a broader set of vulnerabilities, respectively.