How to mitigate internal cyber threats