Malicious insider incidents may be less frequent than inadvertent user missteps, but they can cost organizations big time.