Most corporate security spending is aimed outward: toward firewalls, perimeter fencing, and access control systems built to keep unauthorized people out. Insider threats break that model, because the person causing the damage already has a badge, a login, and every reason to be in the building. Understanding why someone with legitimate access turns into a security risk has less to do with technology than it does with psychology, and the research on that question is becoming harder to ignore.