Since a subcontractor’s network was compromised, “this is more akin to an internal misuse,” said Chris Morales, head of security analytics at Vectra. “The trusted insider is the hardest thing to protect for and even harder to monitor.”