Internal users (employees, contractors and third-party staff) have direct knowledge and experience in a variety of internal systems, on corporate systems and even in physical and logical SCADA network and installation details.Therefore, a disgruntled employee can take advantage of this knowledge, as well as the privileged physical and logical access to the organization’s systems, to carry out malicious activities with a lesser effort than an external attacker and with a much reduced chance of being detected in the short run.This makes them very dangerous, and for this reason the internal users’ accesses and activities need to be restricted on a need-to-know and the least privilege principles and monitored when accessing sensitive or critical systems, as well as providing employee awareness and training to allow them to detect unauthorized behaviours.