I was watching a CSPAN hearing while Marriott and Equifax CEO’s tap-danced around the cyber-security issue. They ignored the potential insider threat—and the Congress-critters questioning them were clueless as well.
You are correct—most data breaches are not hacks at all.
They are inside jobs.
The first suspects should always be employees with access to the hardware and software.