The statement is considered true because internal threats come from within the organization and can include malicious insiders, compromised user credentials, or even employees unintentionally causing harm. These threats are harder to detect because insiders have legitimate access to the network and its resources, and therefore can exploit this access to cause damage, steal data, or introduce malware without immediate detection. By contrast, external threats often must find ways to breach external defenses before they can cause harm, which allows for more opportunities for detection and prevention.