Malware comes from the outside. Stealing company secrets and selling them is what I would be worried about from internal threats. Either way least access necessarily where possible is a good strategy.