high-risk individual

A classification applied to a person — typically a user, employee, contractor, or other organizational insider — for whom credible evidence indicates a significant likelihood of causing harm to organizational systems, data, assets, or operations, either through malicious intent or as a vector adversaries can exploit. The category is operationalized in access-control and incident-response policy: once someone is designated high-risk, controls such as time-bounded account disablement, heightened monitoring, and expedited notification of relevant personnel are triggered. Across the field the designation is context-driven and organization-defined, covering a spectrum from the disgruntled insider with demonstrated intent to the compromised account holder through whom external threat actors act.