So many organisations spend considerably money in external defence and yet are very lazy about cancelling passes and logins for people on their last day. I don't know what the current split is in terms of attacks but a lot of attacks do come internally from staff existing or recent ex staff and it should absolutely be given the same level of thought.

As with most crimes, the vast majority of victims know the perp.