A bloke with admin access locked out his entire company and demanded 20 bitcoin. He got caught because he Googled "how to cover my tracks" beforehand. The insider threat isn't coming from outside. It's already got your passwords.

https://www.bleepingcomputer.com/news/security/man-admits-to-extortion-plot-locking-coworkers-out-of-thousands-of-windows-devices/