Even though malicious insider threats receive the most hype, most organizations experience more accidental insider threat incidents than intentional, according to a new threat report released by IDC in conjunction with RSA yesterday.

The report can act a good lesson to channel providers on the opportunities presented by customers facing risks from within their organizations, says Christopher Young, vice president of product at RSA, the security division of EMC.

“Now, more than ever, organizations are dealing with the fact that their legitimate user population has got computing power like they’ve never seen before,” he says, emphasizing that access to resources, sensitive information and systems multiplies daily. “That kind of increased surface area for the IT infrastructure is going to create a whole series of risks, and it will create the opportunity for the channel to help secure those assets.”

IDC analysts Brian Burke and Christian Christiansen surveyed 400 CXOs to develop the report. They wrote that 52 percent of those surveyed characterized insider threat incidents as primarily accidental and 26 percent thought these incidents were an equal combination of deliberate and accidental. Only 19 percent of organizations thought the insider threat was mostly from deliberate acts.

In aggregate, those surveyed reported experiencing 58,000 insider-related security incidents in the past year. Among those, unintentional actions by insiders were responsible for most of incidents. Organizations experienced an average of approximately 14.4 incidents of unintentional data loss per year.

These types of incidents may not be as "sexy" as the splashy stories of malicious fraud conducted by disgruntled employees, but they’re imminently more problematic to enterprises, says Young.

“It is sometimes harder to gain visibility on the unintentional risks,” he says. “Like the person who accesses a file inadvertently or whose account is used inadvertently or who e-mails out a document that shouldn’t have been sent or somebody who loses a piece of media that has sensitive information on it.”

According to Burke and Christiansen, because the risks inside the organization vary so much, enterprises must take a much more holistic approach to information protection.

“IDC believes a framework approach will provide improved efficiencies, better visibility and effective security for the internal risks outlined in this paper,” they wrote. “The challenge of managing insider risks is too complicated and complex for a single point solution, such as DLP or authentication, to manage alone.”

This framework-based approach is not only a suggested best practice, but it is also provides channel partners with a mode and method of selling security that can serve customers while offering a sustained revenue model.

“That's a great opportunity for a channel partner to not just resell a product but also provide all of the services that are required for that product to exist in the context of a good overall information-centric program for organizations,” Young says. “It’s an opportunity for a channel partner to go in, help customers assess risk, set policy and then put the right products in place that support that program.”