Nothing Really New
I remember some security training way back in the late Dark Ages. Much of what they said was the biggest problem was insiders who are disgruntled, financially in trouble, or too eager to please not professional moles. Add a couple of more categories to the old list such as hoarders, etc. Each group has to be approached correctly with the disgruntled the most likely to make the initial contact.
One issue that was true then and is still true today, there is a lot of non-classified information that does not seem important. But if it is collected routinely it can give a picture of organizational changes and new priorities. Back in the Dark Ages this was commonly a phone directory.