The distinction between insiders and outsiders isn't very useful. Security pros just shouldn't trust anyone. Proper controls must be in place to protect data from both internal and external attack vectors. Whether the right number is 73% or 27% doesn't matter if an insider has created a breach. Or an outsider, for that matter.
Reading deeper into the Verizon report (pdf), it's clear that many of the breaches could have been avoided by updating devices on a timely basis and making sure configurations were locked down. Again, both of these issues are pretty simple security practices. People should focus on protecting important data rather than making artificial delineations between insiders and outsiders.
The last point is that Verizon's data set is skewed toward outsiders. Many insider attacks are never reported, nor do they bring in fancy forensic investigators (like Verizon) to clean up the mess. Yet, when the breach happens from outside, organizations usually have to disclose and tend to bring in outside experts.
Verizon's study definitely has value; it's opened up the eyes of a lot of people. But it's important to put it in the proper frame of reference and make sure to draw the right conclusions.
This was first published in September 2008