Insider Threat: Mission Domain Intelligence Guide

The insider case that goes to court usually has a boring first indicator: an access request that was granted because refusing it would have been awkward.

What Insider Threat covers as a mission domain

Insider threat work addresses harm caused by people with legitimate access: employees, contractors, suppliers and partners. It spans deliberate theft of intellectual property or personal data, fraud, sabotage, unauthorised disclosure, recruitment by a foreign service or organised crime group, coerced insiders acting under threat, and the far larger volume of negligent incidents. The discipline is multidisciplinary by necessity, combining personnel security, human resources process, legal oversight and technical monitoring, and it lives or dies on proportionality and governance rather than on detection technology.

Programmes usually distinguish malicious insiders acting for gain or grievance, recruited or coerced insiders working to an external tasking, and negligent insiders who cause harm without intent. Facilitated insiders, planted deliberately in ports, logistics, banking or telecommunications by organised crime, are a distinct and growing category. Each requires a different response: prosecution, counter-intelligence engagement, safeguarding, or process redesign.

Why it matters

Insiders bypass the perimeter entirely and understand which controls are observed. Losses concentrate in the most valuable assets: research portfolios, customer databases, source code, trading positions and safety-critical processes. Facilitated insiders in logistics enable large-scale trafficking. Poorly governed monitoring is itself a harm, damaging trust across a workforce and exposing an organisation to employment claims and regulatory action that outlast the original incident.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

Bulk download or export from a repository shortly before a resignation, particularly of material outside the person's current project
Access to systems and record sets with no relationship to the role, obtained through a legitimate but unexamined request
Transfer of data to personal cloud accounts, removable media or personal email, often staged in small volumes to avoid thresholds
Badge or remote access at hours inconsistent with the individual's established pattern and with no corresponding work output
Repeated requests for policy exceptions, elevated privileges or audit exemptions, each individually reasonable
Concealed contact with a competitor, foreign institution or intermediary that should have been declared under existing policy
Unusual printing, screenshotting or photography volumes involving controlled material or restricted areas
In logistics and port settings, staff repeatedly rostering onto specific container movements or accessing manifest data outside their remit

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

CERT National Insider Threat Center (Carnegie Mellon SEI) — Large corpus of adjudicated insider cases, patterns of behaviour and control recommendations
UK NPSA personnel security guidance — Pre-employment screening, ongoing personnel security and insider risk governance models
US National Insider Threat Task Force materials — Programme maturity frameworks, hub structures and minimum standards for government-facing organisations
Department of Justice and national prosecution announcements — Documented economic espionage and trade secret cases with charging detail and evidential patterns
Verizon DBIR insider and misuse analysis — Comparative incidence data separating malicious misuse from error across sectors
ISO 27001 and 27002 controls — Baseline control expectations for access management, screening and separation of duties that auditors will test against
Europol reporting on criminal infiltration of logistics — Typologies of facilitated insiders in ports, airports and freight, with recruitment and tasking patterns

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

Identify what actually needs protecting — Define the crown jewel assets and the roles with access. A programme that monitors everyone equally protects nothing efficiently.
Stand up lawful governance — Agree a multidisciplinary hub with human resources, legal, security and, where required, employee representatives, and document lawful basis and proportionality before any monitoring.
Baseline normal behaviour — Establish role-based norms for access, volume and timing, so deviation is measured against peers rather than against an arbitrary threshold.
Triage with context — Assess technical alerts alongside known business context, such as an approved project migration, before any inquiry touches the individual.
Escalate proportionately — Move from monitoring to inquiry to interview on defined thresholds, preserving evidence to a standard that supports both disciplinary and criminal outcomes.
Remediate and learn — Fix the access path that allowed the harm, record the case anonymously for pattern analysis, and review whether earlier intervention was possible.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

Human Intelligence — Information from People, Ethically Obtained
Cyber Intelligence — Adversary Activity in Networks and Systems
Criminal Intelligence — Intelligence Supporting Criminal Investigation
Identity Intelligence — Resolving and Verifying Who Someone Is
Legal Intelligence — Law, Litigation, and Regulatory Intelligence
Accounting Intelligence — Financial Statements and Accounting Analysis

Worked in these data points

Person / Name — A named individual — the subject of identity resolution and profiling.
Email Address — Electronic mail address tied to an individual or organization.
Username / Handle — Screen name or handle used across online platforms and services.
File / Document — A file or document artifact — malware sample, leaked document, image, or email attachment.
Credential / API Token — An exposed secret — API key, token, or JWT — granting access to systems and data.
Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
Court Case / Docket — A filed legal proceeding — the authoritative record of disputes, judgments, and enforcement.

Adjacent mission domains

Inside the platform: where Insider Threat lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

domain.php?d=insider — Insider Threat dashboard
theater.php?d=insider — Threat theater view
search.php — Person / Name profile
email-profile.php — Email Address profile
correlate.php — Correlation graph
cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Insider Threat:

Insider Threat Review — a step-checked workflow with the pivots, sources and handling rules already wired in.
Breach & Credential Exposure — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

Threat Hunt
Correlate Infrastructure
Run Alert Rules
Summarise (Copilot)
Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Identify what actually needs protecting is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
Building the picture. A single indicator is rarely the story. Baseline normal behaviour turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
Producing something actionable. Analysis that ends in a document nobody can use is wasted. Remediate and learn feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Insider Threat

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence organisations run insider risk as personnel security fused with counterintelligence. The concerns are unauthorised disclosure, foreign recruitment of cleared personnel, sabotage and misuse of access to operational information. Analysis supports vetting decisions, aftercare between clearance reviews, and the security education that shapes reporting culture. It feeds counterintelligence assessments and force protection briefings, particularly around deployments and access to allied material. Constraints are significant: monitoring of service personnel and civilian staff operates under defined legal authority and welfare obligations, adverse information must be handled through the vetting process rather than informally, and mental health indicators must never be treated as security indicators in themselves.

🕵 National intelligence

For national services this is counterintelligence in its most consequential form, since a single insider can compromise sources, methods and people. The discipline combines continuous evaluation, technical monitoring of privileged access, financial and foreign contact review, and behavioural science on the pathway from grievance to action. Fusion matters: a financial anomaly alone means little, whereas the same anomaly alongside unexplained foreign travel and unusual repository access means a great deal. Handling is intensely sensitive because an investigation that leaks destroys both the case and the individual's life if they are innocent, so compartmentation and legal oversight govern every step.

👮 Law enforcement

Law enforcement encounters insiders as theft of trade secrets, corruption, unauthorised disclosure and data misuse, including within policing itself. Evidence must be gathered lawfully and to a standard that survives challenge: access and audit logs with authenticated provenance, forensic images of devices with documented custody, and communications obtained under proper process. Employment investigations and criminal investigations have different rules, and material gathered under an employment power may be inadmissible or challengeable if the boundary was crossed carelessly. Charging typically requires proving unauthorised access or dishonest intent, which is where contemporaneous policy acknowledgement and access control records become decisive.

🔍 Private investigation and corporate security

Corporate investigators handle the majority of these cases: departing employees taking client lists, source code exfiltration, procurement fraud and data misuse. Work is bounded by employment law, data protection and the terms of any monitoring notice given to staff. Covert surveillance of employees generally requires a documented necessity and proportionality assessment, and in some jurisdictions consultation with employee representatives. Interviewing must respect the employee's rights, and evidence obtained through covert access to personal accounts or devices is usually unlawful. Reports should be written for an employment tribunal audience as well as a criminal one, since that is the more likely forum.

📰 Journalism and OSINT media

Reporting on insider cases involves people who may be whistleblowers, criminals, or both, and the distinction is often contested. Verification means examining documents for authenticity, understanding what access the person actually held, and testing the organisation's account against records. Whistleblower protection frameworks matter to the story and to the person's exposure. Source protection is acute here because the pool of people with the relevant access is often tiny, so the detail published can identify them regardless of anonymity. Right of reply should extend to the individual as well as the organisation, and allegations of disloyalty deserve the same scepticism as any other institutional claim.

🌍 NGO, humanitarian and human rights

Civil society organisations face insider risk with heightened stakes because their data identifies people at risk, and with weaker controls because trust substitutes for process. Practice should be protective rather than adversarial: minimise who can access beneficiary data, log access to sensitive records, and treat unusual access as a safeguarding issue for the people in the data. Where a staff member is under pressure from a state actor, they may be a victim of coercion, and the response should reflect that. Duty of care includes not exposing a coerced employee to danger by publicising an internal investigation.

🎓 University and research

Research on insider threat suffers from a very small confirmed case population and heavy reliance on post hoc narrative, which produces indicator lists with poor predictive value. Sound methodology states base rates explicitly, avoids inferring causation from retrospective accounts, and tests whether proposed indicators discriminate against the enormous population of employees who exhibit them without offending. Ethics approval is essential where research involves employee monitoring data, and access is normally through anonymised or synthetic datasets. Publish the false positive characteristics of any model proposed, since deployment consequences fall on individuals, and be explicit about the limits of behavioural prediction.

Playbook: working Insider Threat end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish governance before capability

Agree who owns the programme, who authorises escalation, and which functions sit on the review panel: security, human resources, legal, data protection and often a union or staff representative. Define thresholds in writing before any monitoring is switched on. A good output is a charter that states what is monitored, why, on what lawful basis, and who may see the results, published to staff rather than concealed from them.

Phase 2 — Identify critical assets and privileged access

Determine what would actually cause serious harm if taken, altered or disclosed: source code, client data, research, beneficiary records, safety systems. Then establish who can reach it and by what route, including administrators, contractors and service accounts. The output is a short list of crown jewels with an access map, which focuses monitoring on a manageable population rather than surveilling everyone equally.

Phase 3 — Baseline normal behaviour

Understand what ordinary work looks like for each role before defining anomalies: developers do copy code, researchers do download large datasets, and sales staff do access client records. Baselines must be role specific or the programme drowns in false positives and staff lose confidence. A good output is a documented normal range per role, agreed with the managers of that function so the thresholds are defensible.

Phase 4 — Instrument the exits

Focus telemetry where data leaves: removable media, personal cloud storage, webmail, printing, screenshots and bulk export from business systems. Combine with access logs from the systems holding critical assets. Retention should be defined and minimal. The output is coverage of the egress paths that matter, documented so that a gap is a known gap rather than a surprise discovered during an investigation.

Phase 5 — Correlate signals rather than chase single indicators

No single indicator is meaningful. The programme's value comes from combinations: a resignation notice alongside unusual repository access and connection of an unrecognised device, or a procurement approval pattern alongside an undisclosed relationship. Set thresholds that require multiple independent signals within a window. A good output is an alert queue small enough for a human panel to review properly, because volume destroys the quality of judgement.

Phase 6 — Screen for coercion and vulnerability

Some insiders are recruited, blackmailed or acting under threat to family, and a proportion are themselves victims. Before treating a case as deliberate wrongdoing, look for indicators of coercion: sudden financial distress, contact from a foreign service, threats, or a family member at risk abroad. Where those indicators exist, the response involves protection and possibly law enforcement rather than discipline alone. This assessment is both ethical and practical, because it changes the entire handling strategy.

Phase 7 — Investigate proportionately and lawfully

Escalate through defined stages, using the least intrusive means capable of resolving the question. Document the necessity and proportionality assessment at each step. Preserve evidence properly from the outset, including device images and authenticated log exports. Keep the circle small. A good output is an investigation record showing that each intrusive step was authorised, justified and no broader than needed, since that record is what protects the organisation and the individual.

Phase 8 — Manage the human process fairly

Run the employment process in parallel with, and separate from, any criminal referral. Give the individual the opportunity to respond, and be aware that a plausible innocent explanation is common because the underlying behaviours are common. Ensure welfare support and consider mental health implications for someone under investigation. The output is a decision that would survive tribunal scrutiny, made on evidence rather than on the discomfort of suspicion.

Phase 9 — Refer criminal matters properly

Where the conduct is criminal, decide with counsel whether to refer, and package evidence to a standard police can use: preserved originals, custody records, and a clear account of what access the person held and what policies applied. Understand that referral hands control of timing to the authorities. Record the rationale for referring or not, because inconsistent treatment across cases is itself a legal risk.

Phase 10 — Close the control gap

Every case reveals a control that failed: excessive standing access, an unmonitored egress path, a joiners and leavers process that left credentials live. Fix the specific gap and then ask where else the same weakness exists. The output is a remediation with a named owner and a verification step, rather than a lessons learned document that circulates once and changes nothing.

Phase 11 — Measure and defend the programme

Track outcomes including false positives, time to resolution and the proportion of cases resolved without intrusive measures. Report to governance regularly and be prepared to justify the programme to staff and regulators. A programme that cannot demonstrate proportionality will eventually be curtailed, usually after a case where it overreached. Publish an anonymised summary internally so employees see that it is used sparingly and fairly.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
CERT Insider Threat Center research	Open	Case based research on insider incidents, patterns of behaviour and organisational controls from Carnegie Mellon.	Evidence base for indicator selection and control design grounded in documented cases.
CISA Insider Threat Mitigation resources	Open	United States government guidance on building insider risk programmes, governance and detection approaches.	Programme design reference and material for briefing executives on structure and scope.
CPNI and NPSA personnel security guidance	Open	United Kingdom national guidance on personnel security, pre-employment screening and ongoing personnel assurance.	Practical control guidance for vetting, aftercare and reporting culture in sensitive organisations.
MITRE ATT&CK	Open	Technique taxonomy including collection, staging and exfiltration behaviours applicable to insider activity.	Structuring detection coverage for data staging and egress techniques used by insiders.
Data protection authority guidance on employee monitoring	Open	Regulatory guidance on lawful basis, transparency, necessity and proportionality for workplace monitoring.	Establishing the legal boundaries of monitoring before capability is deployed. Also defines transparency requirements toward the workforce.
ISO/IEC 27002 control guidance	Licensed	Control catalogue covering access management, human resource security and logging and monitoring.	Mapping insider risk controls to a framework auditors and clients already recognise.
Court records and unsealed prosecutions	Open	Charging documents describing trade secret theft, economic espionage and data misuse cases in detail.	Grounded case material showing how insiders operated and how they were detected.
Verizon Data Breach Investigations Report	Open	Annual analysis of breach patterns including the proportion and characteristics of internal actor incidents.	Base rate context to counter overstated claims about insider prevalence. Useful for correcting vendor claims about the scale of insider risk.
Employment tribunal and case law databases	Open	Decisions on dismissal, monitoring, privacy and disciplinary process arising from workplace investigations.	Understanding what evidentiary and procedural standards actually survive legal challenge. Shows where monitoring and dismissal decisions have previously failed.
Financial disclosure and conflict of interest registers	Open	Declared interests, directorships and relationships maintained by employers, regulators or public bodies.	Checking declared relationships against evidence of undisclosed conflicts in procurement cases. Useful where a conflict was declared in one register but not another.
NIST SP 800-53 control catalogue	Open	Comprehensive security and privacy controls including audit, access enforcement and personnel security.	Selecting and documenting the specific controls that address privileged access misuse. Also supports mapping controls for audit and client assurance.
Behavioural science literature on workplace deviance	Licensed	Peer reviewed research on grievance, rationalisation and the pathway from intent to harmful action.	Understanding why indicator lists have poor predictive value and where intervention works.
Whistleblowing regulator and charity guidance	Open	Guidance on protected disclosure, lawful reporting routes and employer obligations toward whistleblowers.	Distinguishing protected disclosure from unauthorised exfiltration before an investigation escalates. Also identifies the reporting routes an employee should have been offered.
Sector ISACs and peer forums	Registration	Peer sharing of insider case patterns, targeting of staff and recruitment approaches observed in the sector.	Early warning about approaches being made to employees across an industry. Sharing is usually under membership terms with handling restrictions.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Insider Threat. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

User and entity behaviour analytics — Scores deviations from role based baselines across access and egress events. Limitation: high false positive rates without role specific tuning and a human review panel.
Data loss prevention — Detects and blocks sensitive data leaving via defined channels. Limitation: easily bypassed by photographing a screen, and classification quality determines everything.
Privileged access management — Brokers, records and time bounds administrative access. Limitation: value depends on eliminating standing credentials, which is where most implementations stop short.
Access log aggregation with retention controls — Provides authenticated records of who accessed what and when. Limitation: log integrity and time synchronisation must be provable or the evidence is challengeable.
Digital forensic imaging suites — Preserve device state for examination with hashing and custody records. Limitation: personal devices and cloud accounts are usually outside lawful reach.
Case management with restricted access — Keeps investigation records compartmented and auditable. Limitation: only protective if access is genuinely restricted rather than open to a wide security team.
Joiners, movers and leavers automation — Removes access promptly when roles change or employment ends. Limitation: rarely covers contractors, service accounts and shadow systems where the residual risk concentrates.
Anonymised analytics with staged de-anonymisation — Allows pattern detection without identifying individuals until a threshold is met. Limitation: requires strong governance to prevent casual unmasking.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

Base rates destroy most indicator lists. Financial stress, disgruntlement and unusual working hours describe a large fraction of any workforce, so an indicator only earns its place if it discriminates against that population.
The strongest predictor available is a change in pattern near a departure event. Resignation, redundancy consultation and a failed promotion all precede a measurable share of exfiltration cases, and the window is short.
Distinguish exfiltration from protected disclosure early. An employee removing evidence of wrongdoing may have legal protection, and an organisation that investigates them aggressively converts a compliance problem into a scandal.
Coerced insiders are common in state related cases. Treating a person under threat to their family as a straightforward offender loses both the intelligence opportunity and the chance to protect someone who is also a victim.
Monitoring that staff do not know about is usually unlawful and always corrosive. Transparent, proportionate monitoring with published thresholds produces better reporting culture and survives legal challenge.
Most cases are detected by colleagues, not by systems. Investment in a reporting route that people trust, with protection for the reporter, outperforms most analytic tooling in measured outcomes.
Every case exposes a standing access problem. The recurring root cause is not a sophisticated insider but permissions granted for a project three years ago that nobody ever removed.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Insider Threat is producing anything, and they are worth baselining before you change process or tooling.

Proportion of cases identified through colleague reporting versus technical detection, tracked to show whether reporting culture is working.
False positive rate of escalated alerts, measured as cases closed with no adverse finding after intrusive review.
Median time from first signal to case resolution, separated by outcome so that lengthy inconclusive cases are visible.
Percentage of privileged accounts with standing access eliminated in favour of brokered, time bounded access.
Access revocation completion time for leavers and role changes, including contractors and service accounts. Measured from the effective date, not from the ticket being raised.
Share of investigations where necessity and proportionality assessments were documented before each intrusive step. Sampled by an independent reviewer rather than self certified.
Recurrence rate of the same control gap across separate cases, which measures whether remediation is real.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

Base rate neglect: with rare events and broad monitoring, the overwhelming majority of alerts are innocent and the programme drowns
Psychological profiling beyond competence, which produces discriminatory outcomes and does not survive legal challenge
Acting on technical signals without business context, and confronting someone over an activity their manager authorised
Excluding contractors, suppliers and joint venture staff from scope, where the least-vetted access frequently sits
Treating a protected disclosure or whistleblowing act as an insider incident, which is both unlawful and reputationally severe
Monitoring so intrusive it corrodes trust, causing staff to route around systems and destroying the reporting culture that catches real cases

Legal and ethical considerations

Employee monitoring requires a lawful basis, a documented necessity and proportionality assessment, and in many jurisdictions a data protection impact assessment and consultation with works councils or unions. Covert monitoring is exceptional and usually needs specific authorisation. Keep disciplinary and criminal evidential standards distinct, and preserve material properly if prosecution is possible. Whistleblowing protections must be assessed before any adverse action. Health information and inferences about personal circumstances are special category data and generally should not enter a security triage process at all.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Insider Threat, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 7 data points, 5 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is behavioural profiling of employees defensible?

Only within narrow bounds. Profiles built on personal characteristics, mental health, protected attributes or personality inferences are legally hazardous and empirically weak. What is defensible is role specific behavioural baselining of work activity, disclosed to staff, with thresholds requiring multiple independent signals and human review before any escalation. Document the lawful basis and the necessity and proportionality assessment. Treat any model as decision support rather than a verdict, record its false positive characteristics, and never allow an automated score alone to trigger an intrusive step against an individual.

How do we handle a suspected insider who may be a whistleblower?

Pause and take legal advice before escalating. Ask what the material actually concerns: evidence of wrongdoing by the organisation attracts protected disclosure regimes in many jurisdictions, and investigating or dismissing the person can constitute unlawful detriment. Establish whether internal reporting routes were used and whether they failed. Separate the question of whether policy was breached from whether the disclosure was in the public interest, since both can be true. Handle the matter through a channel that does not involve the people whose conduct is being alleged, and document that separation.

What is the realistic detection window for data theft before departure?

Usually the final weeks of employment, and often the days immediately after a resignation is submitted or a redundancy discussion occurs. That is when staged copying, bulk downloads, personal cloud uploads and removable media use concentrate. Practical programmes tighten monitoring on critical assets during notice periods, restrict bulk export capability, and run a departure review of access logs for the preceding period. The window is short, which is why coupling human resources events to security telemetry matters more than continuous surveillance of the whole workforce.

Can we look at an employee's personal email or device?

Generally not without consent or a specific legal power, and doing so can be a criminal offence as well as an employment law breach. Corporate systems and corporate devices used within a disclosed monitoring policy are a different matter, but even there the assessment of necessity and proportionality has to be documented. If personal accounts genuinely hold the evidence, that is a matter for law enforcement with the appropriate legal process, or for a civil court order. Improvised access destroys admissibility and creates liability that usually exceeds the original loss.

How large should an insider risk team be?

Small enough to keep the circle tight and resourced enough to review every escalation properly. The failure mode is an alerting system generating more cases than the panel can consider, which leads either to superficial review or to quiet abandonment. Size the alert threshold to the review capacity rather than the reverse. Most organisations get better value from a very small trained team with strong governance, good access controls and a trusted reporting route than from a large monitoring operation with weak thresholds and no legal oversight.

Does monitoring damage trust more than it prevents harm?

It depends entirely on transparency and proportionality. Covert, broad monitoring that staff discover later damages trust severely and produces less reporting, which removes the most effective detection channel there is. Disclosed monitoring focused on critical assets, with published thresholds, staff representative involvement and an honest internal account of how rarely it is used, is generally accepted. The test is whether the organisation would be comfortable explaining the programme to its own workforce in detail, and if not, the programme rather than the explanation needs to change.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

ISO/IEC 27001 and 27002, covering access control, human resource security, logging and monitoring within an information security management system.
NIST SP 800-53, providing the detailed control catalogue including audit, access enforcement and personnel security.
GDPR and equivalent regimes, requiring lawful basis, transparency, necessity and proportionality for employee monitoring.
Employment law and tribunal standards governing disciplinary process, evidence and fair dismissal.
Whistleblower protection legislation such as the EU Whistleblowing Directive and national equivalents, defining protected disclosure.
National personnel security standards and vetting frameworks governing clearance, aftercare and adverse information handling.
ISO/IEC 27037 for preservation of digital evidence gathered during internal investigations.
Economic espionage and trade secret legislation, which defines the criminal threshold for misappropriation.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

Common Sense Guide to Mitigating Insider Threats — CERT Division, Software Engineering Institute, Carnegie Mellon University. Case based research on insider incidents and mitigating controls.
Insider Threat Mitigation Guide — Cybersecurity and Infrastructure Security Agency. Government guidance on programme design, governance and detection.
Personnel security guidance — National Protective Security Authority. United Kingdom guidance on screening, aftercare and insider risk controls.
Employee monitoring guidance — Information Commissioner's Office. Regulatory guidance on lawful workplace monitoring.
Data Breach Investigations Report — Verizon. Annual breach dataset including internal actor incident characteristics.
Security and Privacy Controls, SP 800-53 — National Institute of Standards and Technology. Control catalogue covering access, audit and personnel security.
Trade secret and economic espionage prosecutions — US Department of Justice. Primary charging documents describing insider misappropriation cases.
MITRE ATT&CK enterprise matrix — MITRE. Technique taxonomy covering collection, staging and exfiltration behaviours.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: correlates access, egress and personnel signals under governed thresholds, with proportionality controls built in. Explore the platform, or browse the rest of the library by following any tag above.