An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device. Which of the following best describes the user’s activity?

The user's activity is an insider threat because it involves an authorized individual (the user) misusing their legitimate access to an organization's assets (data) for unauthorized purposes (copying large amounts of data to a personal device after hours). This action poses a significant risk to data confidentiality and integrity. Penetration testing is a simulated attack to find vulnerabilities, not an actual data exfiltration event by an employee. A phishing campaign is a social engineering attempt to trick users into revealing information or installing malware, which doesn't describe this scenario. An external audit is a formal review of an organization's financial statements or operational processes by an independent party, unrelated to a user copying data.