I’m curious if others here have experienced this, and how you interpreted it afterward.

When a serious security incident happens — especially one you believed you were reasonably well prepared for — do you tend to suspect:

• A highly capable external attacker with deep knowledge of your environment, or
• An insider threat involving someone with privileged/internal knowledge who either directly caused the incident or helped enable it while making it appear external? By “insider threat,” I mean not only direct employees, but also people working for third-party vendors or infrastructure providers with some level of access to your systems. Motivations could range from money or revenge to fun.

Did you ever feel a correlation between serious security incidents and (expensive) vendor contracts being signed right afterwards?

I’m also curious how people distinguish between:

• A genuinely sophisticated external compromise, and
• An attack where insider knowledge played a major role behind the scenes.

Have you ever dealt with an incident where the level of access, timing, or precision made you question whether it could really have been purely external?

Not looking for conspiracy theories — more interested in how experienced admins/security teams think about attribution when something significant happens despite having solid controls in place.