because internal threats are not considered as large of a risk as external risks. because internal attacks never make news headlines and are therefore underestimated. because any employee with access to internal data represents a potential security risk.