Insider analysis

About 18 min read

On this page

Pillar 05 of 05

Insider analysis is the last of the Subject sub-pages and the one that demands the most careful thinking. The person already has access, already knows the systems, and often already knows what the SOC watches for. The methodology has to compensate for all three.

Risk vs. threat

An insider is anyone who has or had authorized access to the organization’s people, facilities, data or systems: employees, contractors, temporary staff, vendors and managed service providers, partners, and former staff whose access was never revoked. It also includes people hired under a false identity, such as the North Korean IT-worker schemes in which a fraudulent remote hire does the job from a laptop someone else hosts, and people an outside party has recruited or paid to act from inside. An insider program scoped to employees alone misses most of that list.

The vocabulary matters. The two words mean different things, and the response differs accordingly.

Insider risk

The possibility that an insider’s actions (intentional or not) cause harm. Includes mistakes, policy violations, unsafe habits, and well-meaning workarounds. Most insider risk is not malicious. Most insider risk is also not random; it follows the same patterns of pressure, change, and incentive that any human behavior does.

Insider threat

An insider acting with intent to harm the organization. Theft of intellectual property, sabotage, fraud, espionage, exfiltration to an external party, including insiders recruited or paid by an outside party. Far rarer than risk, but with disproportionate impact when it happens. The methodology for detecting threat overlaps with risk monitoring but requires escalation patterns that the rest of the SOC may not be used to.

Treating all insider activity as threat poisons the relationship with the rest of the organization and produces investigations that find nothing useful. Treating all of it as risk misses the rare but consequential intentional cases. So the analyst starts with risk and moves the label to threat only when the evidence supports it. Three boundaries apply to the vocabulary:

The label is a hypothesis about intent, revisable as evidence arrives.
The split is a practitioner convention. NIST (SP 800-53r5) and CISA both define insider threat to include unwitting or unintentional acts, so map these labels to your organization’s policy vocabulary.
The label never delays response. Whichever vocabulary applies, confirmed harmful activity is contained and escalated on act, asset, and impact, with intent resolved in parallel.

CASE STUDY

Edward Snowden: when triage misses intent

Snowden’s actions at the NSA were not negligent errors. They were a deliberate, sophisticated insider threat. He had authorized access, knew the systems, and exfiltrated classified material over an extended period. Much of the activity rode legitimate admin access, and the signals that existed went unheeded. He used automated web-crawler software to copy an estimated 1.7 million files. It set off no automated alarm, even though NSA rarely used crawlers internally, because the Hawaii site lacked the activity monitoring deployed at headquarters (reporting on the New York Times findings). When he was questioned, he cited routine sysadmin work, and the explanation was accepted. According to a February 2014 NSA memo to Congress, he also captured a civilian coworker’s public key infrastructure (PKI) password and certificate, which gave him access beyond his own (NBC News on the memo); Snowden has publicly denied stealing any passwords.

Snowden was a contractor (Dell, then Booz Allen Hamilton), not an NSA employee: an insider program scoped only to employees would not have covered him.

The lesson for Subject: two cheap checks would have fired. Environment rarity (a crawler where crawlers are rare) and entity context (volume and data sensitivity far beyond this admin’s own history and his peers’). And a role-based justification is a claim to verify against tickets and approvals, not a closure. The methodology weights every anomaly by the actor’s role and the sensitivity of the data touched (see the behavioral framework); that weighting is what keeps a sophisticated insider’s quiet activity from blending into normal noise.

A second case: the marketing team and the data loss prevention (DLP) workaround

An illustrative composite (the numbers are representative, not from a published incident): a marketing team deliberately worked around Data Loss Prevention controls, with no intent to harm, by converting confidential documents into image files and sharing them externally with a client during a collaboration. The workaround inadvertently exposed records for 3,200 customers.

Investigation found no malicious intent. The behavior stemmed from frustration with a secure file-sharing tool that added an average of 27 minutes to each transaction. The team was solving a usability problem, not stealing data.

The remediation focused on the underlying friction: the approved sharing workflow was redesigned to take 4 minutes per exchange (down from 27), and a tailored process was added for marketing’s specific collaboration needs. Within 30 days, 92% of the team’s external exchanges were going through the approved workflow.

This is insider risk, not threat: a deliberate act with no intent to harm is still insider risk. The label decided the lasting fix, not the immediate response: the exposure was scoped, contained, and run through the notification question before anyone weighed motive. With that handled, the investigation pivoted from forensics to process improvement. Treating it as threat would have produced an enforcement action that did not actually fix the cause.

The Insider Threat Matrix

The Insider Threat Matrix at insiderthreatmatrix.org organizes insider tradecraft into five sections. They are facets of a case, not a sequence an insider marches through. Used as a lens, the matrix gives analysts a vocabulary for describing what they are seeing.

Motive

Why an insider might act. Financial gain, ideology, grievance, ego, coercion, or recruitment by an external party. Rarely visible in telemetry. When it surfaces at all, it surfaces to HR and managers, and it reaches the case only through a referral.

Means

What access and capability the insider already has. The matrix catalogs the techniques an insider can use without ever needing to “hack in”: they are already inside.

Preparation

The steps an insider takes before the harmful action: reconnaissance of internal systems, acquisition of additional credentials, learning what the SOC watches. These are the early signals if anyone is looking.

Infringement

The actual harmful action. Theft of intellectual property, sabotage, fraud, exfiltration. The visible event most investigations start from.

Anti-forensics

What the insider does to make the action hard to trace. Log clearing, timestomping, using accounts they should not (or accounts that “belong” to someone else). Cleanup is itself a signal.

Inside each section

Motivations to recognize (selected and paraphrased from the matrix's Motive section)

The full list lives in the matrix’s Motive section. These are the ones triage meets most often.

Financial gain. Data theft or abuse of access for personal profit, often tied to fraud or IP theft. Triage correlates access to high-value assets with anomalous transfers or DLP violations, especially off-hours or to personal destinations.
Coercion or blackmail. External pressure produces abrupt, high-risk actions inconsistent with user history. Sudden privilege escalations or sensitive access outside normal duties, often with concealment.
Revenge or resentment. Triggered by demotions, conflicts, perceived mistreatment. Behavior changes after HR actions: unusual access, deletions, misconfigurations on critical systems.
Curiosity or challenge. Non-malicious boundary testing by privileged users. Lateral movement or unauthorized exploration; weigh against training environments.
Ideological beliefs. Political or personal convictions producing data leaks or sabotage. Anonymization tools, external data staging , access aligned with the activism target.
Leaver. Departing employees taking data on the way out; see “Access creep before a known event” and “The leaver window” below.
Entitlement. The belief that one owns the work product.
Espionage. Acting for a foreign state or competitor.
Third-party collusion. Insiders bribed or recruited by an outside party.
Human error, lack of awareness, recklessness. Careless behavior creating risk through weak hygiene. Repeated policy violations or mishandled sensitive data without clear malicious intent. This is risk territory, not threat.

Means to assess (paraphrased)

The matrix’s Means section itself lists concrete means: removable media, printing, screenshots and phone capture, personal devices, unrevoked access after a role change, access delegated through a managed service provider, and enterprise AI platforms with broad data reach (see AI in triage). The four groupings below are a triage shorthand for them.

Technical access. Beyond role-based access: residual permissions from previous teams, inherited group rights, lateral-movement paths via shared service accounts. Access path mapping surfaces dormant access that role review misses.
Environmental awareness. Insiders can use knowledge of internal processes, weak controls, or architectural blind spots. Tenure, cross-department experience, and access to internal documentation all increase environmental awareness.
Privileged access. Admins and engineers bypass routine controls by design. Triage applies tighter scrutiny: unusual admin tool use, escalation paths, sensitive system access outside the job pattern.
Physical access. Hardware tampering, offline exfiltration via USB, planted rogue devices. Badge logs, USB telemetry , and secure-zone entry data belong in insider triage.

Preparation activity to watch for

Technical prep. Penetration tools, encryption utilities, scripting platforms not normally required for the role. Often deployed in sandboxed or temporary directories. Monitor for unusual binary executions and failed installs from non-admin paths.
Data gathering. Testing access to datasets outside job scope. Small sample downloads or probing archival stores that escalate in size and frequency. Sudden access to legacy systems or large non-recent datasets is a precursor.
Temporal indicators. Preparation activity shifts to off-hours, weekends, holidays. These windows often coincide with reduced staffing. Alerting on high-sensitivity access during low-visibility hours surfaces this.
Testing security controls. Deliberate threshold-testing: failed logins, policy violations, copying data across classifications. Individual events look benign; the pattern over days or weeks is the signal.

Infringement: how harmful action actually happens

Low-and-slow execution. Rather than one large action, insiders often spread access or extraction over days or weeks, staying below alert thresholds. Repeated small-scale transfers from sensitive systems are worth flagging even when each is under threshold.
Technical execution. The staging pattern from Preparation matures here: the small test queries and sample downloads become extraction at volume. The transition point, sampling turning into bulk movement, is where the case stops being preparation and becomes the act.
Borrowed or reactivated accounts. “Borrowing” accounts from coworkers on vacation, leave, or recently departed. Usage of dormant or newly reactivated identities should be correlated against the original owner’s expected behavior.
Supply chain manipulation. Abusing access to development pipelines or procurement to insert malicious code or alter dependencies. Check last-minute code or dependency changes by high-privilege users against change tickets and independent peer approval; self-approved or ticketless changes are the signal.

Anti-forensics: how insiders try to hide

Technical concealment. Deleting or truncating event logs, scrubbing shell history, tampering with audit trails, overwriting timestamps. Encryption tools or shred scripts deployed shortly after activity. Integrity validation on key forensic sources is the counter.
Behavioral concealment. Working under assumed identities, manipulating ticketing systems, crafting business cases that look legitimate but cover malicious access. Authenticate business justifications against peer approvals and organizational objectives.
Misdirection. Triggering low-impact security events to divert attention from the primary objective. Triage should ask whether simultaneous incidents are causally linked or part of a broader misdirection campaign.
Counter-intelligence. Monitoring SIEM alerts, ticket queues, or detection content to learn how the SOC operates. Compartmentalize investigative workflows and restrict access to detection logic .

What insider analysis catches

Slow-burn data collection

An insider gradually building a personal cache of sensitive documents over months. Each individual access looks legitimate; the trajectory is the signal.

Access creep before a known event

Requesting or accumulating permissions in the weeks before a known departure, performance review, or organizational change. Correlation with the dates an HR referral or joiner-mover-leaver feed supplies is what surfaces this.

The leaver window

The most actionable insider pattern. CERT research on insider theft of intellectual property has repeatedly found that many of those who took data did so within about a month of leaving. Bulk repository clones, mass downloads, or transfers to personal storage during the notice period deserve a look against the person’s own baseline and aggregate peer baselines. The departure date reaches the SOC as a date, not as a reason to suspect anyone.

The remote hire who was never there

A fraudulent remote hire, such as a worker placed by a North Korean IT-worker scheme (the activity Microsoft tracks as Jasper Sleet), holds a real account under a false identity, often on a company laptop hosted by a third party. Signals Subject can see: remote-control tools or IP-KVM devices (hardware that relays a computer’s keyboard, video and mouse over the network) that IT never deployed, sign-ins whose geolocation or network does not match where the laptop is supposed to be, and payroll, HR and identity records that disagree.

The recruited insider

An outside party pays or pressures someone who already has access. Extortion and ransomware groups openly solicit employees to hand over credentials or run a payload, and bribed support staff have sold customer records and account changes. Signals Subject can see: a tool or script never seen on the insider’s host shortly before external activity begins, support-tool lookups of customer accounts with no matching ticket, and remote sessions or new MFA methods that appear right after an insider’s action. Paid collusion is threat territory; a coerced insider may also be a victim. Either way, the outside party makes it an external case too.

Shared-account misuse

A shared account being used by an unexpected person. Hard to detect because the audit trail is intentionally ambiguous. The strongest evidence is attribution: a privileged access management (PAM) check-out or session-recording record, or the originating workstation or jump-host session, that names who held the credential. Without it, baseline the shared account against its expected users and their own sessions at the same time.

Anti-forensic cleanup

Log clearing, shell-history wiping, timestomping, deleting staged archives. Each is a signal in its own right; manual cleanup shortly after a sensitive transfer is a strong intent signal once scheduled jobs and retention scripts are ruled out.

Behavioral vs technical indicators

The strongest insider triage correlates two streams that live in separate teams: human signals (HR, manager observations) and technical signals (logs, telemetry). The SOC holds only the second. The first stays with HR and the insider program and reaches the case as a referral with technical questions. Correlated, the two streams sharpen the risk-versus-threat label (and only the label). Response rides on act, asset, and impact, never on the streams agreeing.

Behavioral indicators (arrive via HR or manager referral; held by HR, not the SOC)

Unusual curiosity. Repeated questions about systems, data classification, or infrastructure outside the person’s role, as reported by a manager. The referral turns it into a technical question: what did the account access?
Schedule changes. Shifts to nights or weekends without business reason, reported by a manager. The SOC’s version is the access timeline, not the report.
Attempts to defeat oversight. Technical attempts to bypass or disable security steps, as observed by a manager or colleague. Disagreeing with a control is not an indicator.
Personal circumstances: not for the SOC. Analysts record observable technical activity. HR-held context reaches the case only through the insider-risk route, and never as analyst-collected notes. The SOC does not record an employee’s health, family, or financial circumstances, mood, or grievances; complaints about pay, conditions or monitoring can be legally protected activity. At most the case notes that an HR referral exists and which technical activity it asks the analyst to check.

Technical indicators

Unsanctioned transfer channels. Forwarding to personal email, browser uploads to personal cloud storage or webmail, CLI sync tools such as rclone, pushes to personal code repositories, AirDrop or USB mass storage, bulk printing, and pasting sensitive content into unsanctioned generative-AI tools, especially from accounts with no history of using them (see AI in triage).
Low-volume data exports just below alert thresholds. Extracting moderate amounts over extended periods is a known evasion tactic. Look for staying-below-threshold patterns.
Privilege bypass attempts. Multiple failed access attempts to restricted systems, or self-approval of elevated permissions.
Compression and archiving outside normal workflows. Zip, tar, or rar files containing sensitive documents in personal folders or shared drives.
Disabling endpoint protections. Turning off antivirus, DLP agents, or logging services. Treat as high-priority and possibly isolate for forensic review.
Accessing dormant accounts or unrelated systems. Reactivating dormant credentials, touching systems unrelated to current responsibilities.
Anonymizers and unsanctioned remote access. Tor, consumer VPNs or proxies; remote-control tools (AnyDesk, TeamViewer) or IP-KVM devices not deployed by IT. Cross-reference with network and endpoint telemetry.

Correlation sharpens the label; harm triggers the response

Technical signals without behavioral context produce benign true positives (admins legitimately disable agents; developers legitimately use scripting tools). Behavioral signals without technical context produce HR friction (someone is having a bad month and the SOC opens an investigation). Correlating the two streams is how the label gets sharper: risk versus threat, mistake versus intent. The label never gates the response. The moment technical evidence confirms harmful activity (data leaving, controls disabled, evidence destroyed, sabotage in motion), the case escalates on act, asset, and impact under the standard escalation criteria, whether or not any behavioral signal exists, and containment does not wait for HR context. Motive gets investigated in parallel by the people authorized to hold it. The two-stream rule governs the opposite direction: behavioral signals alone, without technical corroboration, never open an enforcement case.

Guardrails: the analyst investigates activity, not people

Three rules keep insider analysis defensible. First, presumption of innocence: the SOC does not collect behavioral signals like the list above. They reach the analyst through an HR or manager referral, and the analyst’s job is to check whether technical evidence corroborates the referral, not to build a case against a person. Second, document observable facts only: “account jsmith transferred 4.2 GB to an unrecognized external IP at 02:14 UTC” survives legal review; “Jane is probably stealing data before she quits” is speculation that creates defamation and employment-law exposure, and it becomes discoverable the moment it enters a ticket. Third, mind the base rate: genuine insider threat is rare, and broad indicator lists like these mostly describe innocent people having a hard month. Any single indicator, and most pairs of them, will overwhelmingly flag employees who have done nothing wrong. An indicator justifies looking at telemetry. It never justifies a conclusion.

The four dimensions, insider edition

The four dimensions apply unchanged; what shifts is where an insider’s signal tends to sit. An insider usually passes authentication cleanly, so the weight moves toward authorization, behavior, and relationships.

Authentication: borrowed or reactivated credentials, shared accounts with no individual attribution, and sign-ins from somewhere the person’s laptop is not (the remote-hire pattern).
Authorization: unrevoked access after a move, residual rights from a previous team, self-approved elevation.
Behavior: volume and timing against the person’s own baseline and aggregate peer baselines, especially in the notice period.
Relationships: personal webmail or cloud destinations, competitor domains, unsanctioned AI tools, external collaborators.

Every line is observable technical activity; none of it needs a person’s private circumstances. The working example’s fourth scenario applies them to an HR referral.

Mitigation strategies

Building mitigations is not Subject-phase work; it is the insider program, owned by security leadership with HR and legal, and it exists before and after any single case. The five practices are included because the analyst triages inside them: each one is both a control the program builds and a signal source the analyst reads (an access attempt outside current scope, a segregation-of-duties violation, an HR referral). Read the first sentence of each card as the program’s job and the last as yours.

Least privilege enforcement

Users have access to data and systems required for their current job, with automated deprovisioning of stale roles or inherited access. Role-based reviews feed quarterly compliance and alert suppression logic. Triage flags access attempts outside current scope.

Segregation of duties

No individual can create, approve, and execute sensitive actions on their own. Deployment, access grants, and audit log review live with separate roles. Triage treats violations of this model (especially with emergency access or after hours) as high-risk.

Technical monitoring

Behavioral analytics, privileged session monitoring, endpoint detection tuned for lateral movement and data aggregation. Commercially this is the Insider Risk Management (IRM) category: user and entity behavior analytics (UEBA), DLP and PAM, often joined to HR data through connectors, and deployable only after legal and privacy review (and, where one exists, the works council). Quality alerts come from individual baselines, not just global policy violations. Triage prioritizes events that combine anomalous behavior with elevated privilege.

Cultural approaches

Employees feel safe reporting concerns through clear, non-retaliatory channels. The security culture surfaces early warnings before they become technical events. Triage takes HR referrals as an input alongside log data.

Insider response protocols

Dedicated playbooks for internal actors: evidence preservation without tipping the subject, coordinated containment, post-event review. Mature programs maintain specialized insider threat cells separate from standard incident response, restrict case access to named people, and keep the case out of reach when the subject works in IT or the SOC. Triage preserves evidence under legal hold with a chain-of-custody record, without tipping the subject, and routes the case to the insider cell (or to HR and legal where no cell exists) rather than standard incident response.

Insider investigations need different escalation

An insider investigation is one of the few in triage where the analyst should usually not directly engage the subject. Coordinate with HR and legal before the subject becomes aware they are being investigated. Premature exposure can compromise both the security investigation and any subsequent legal action. Live harm is the exception to the waiting, not to the coordination: if data is leaving, controls are being disabled, or sabotage is in motion, containment proceeds on act, asset, and impact, and HR and legal are brought in at the same time. The special routes table lists who to talk to, and who not to.

Employee privacy is a hard constraint

Insider investigations run inside an envelope of employment and privacy law that varies by jurisdiction. Have counsel confirm how each point applies locally.

Works councils. In much of the EU, works councils must be consulted before employee monitoring is deployed or expanded. In Germany the works council must agree: technical monitoring is a co-determination matter under section 87(1) no. 6 of the Works Constitution Act.
Proportionality and DPIAs. GDPR demands the least invasive measure that answers the specific question, not a general trawl through a person’s digital life. Monitoring that is likely to be high-risk processing can need a data protection impact assessment (DPIA) before it starts.
Notice. Several US states (Connecticut, Delaware, New York and, since 2026, Maine among them) require notice of employee monitoring.
Protected activity. Some behavior that looks like an indicator is legally protected: complaints about pay, conditions or monitoring (section 7 of the National Labor Relations Act in the US; works-council rights in the EU), and disclosures to regulators or counsel (EU Whistleblower Directive 2019/1937, SEC Rule 21F-17, and the Defend Trade Secrets Act immunity at 18 U.S.C. 1833(b)). Route any case touching these to legal before acting.

At triage speed this comes down to one step: before widening collection on a named person, confirm with legal that the collection is authorized for that purpose, and pull only what the question requires. Evidence gathered outside the envelope can be unusable in any disciplinary or legal proceeding and can turn the organization from investigator into defendant.

Sources and further reading

The Insider Threat Matrix, including its Motive and Means sections.
CISA, Defining insider threats, and the CISA Insider Threat Mitigation Guide.
Carnegie Mellon SEI CERT, Common Sense Guide to Mitigating Insider Threats, seventh edition.
The National Insider Threat Task Force (NITTF) insider threat program maturity framework.
NIST SP 800-53 Rev. 5, control PM-12 (insider threat program) and IA-2(5) (individual authentication before shared-account use).

Key takeaway

Start with risk; move the label to threat only on evidence; respond to confirmed harm on act, asset and impact under either label; and keep people-data with HR and legal. Insider analysis applies the same four dimensions as the rest of Subject, with the weight shifted toward authorization, behavior, and relationships, and it escalates through a route that brings HR and legal in early.

Next up

Subject working example

Step-by-step walkthroughs applying Subject analysis to Cases A, B and C, plus an insider referral.

See the working example

Technical details verified 2026-10-13. Product names, defaults and retention change; check your own tenant.

Edit this page on GitHub Report a correction