Insider analysis
Risk vs. threat
The vocabulary matters. The two words mean different things, and the response differs accordingly.
🟡 Insider risk
The possibility that an insider’s actions (intentional or not) cause harm. Includes mistakes, policy violations, unsafe habits, and well-meaning workarounds. Most insider risk is not malicious. Most insider risk is also not random; it follows the same patterns of stress, change, and incentive that any human behavior does.
🔴 Insider threat
An insider acting with intent to harm the organization. Theft of intellectual property, sabotage, fraud, exfiltration to an external party. Far rarer than risk, but with disproportionate impact when it happens. The methodology for detecting threat overlaps with risk monitoring but requires escalation patterns that the rest of the SOC may not be used to.
Why the distinction matters
Treating all insider activity as Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. poisons the relationship with the rest of the organization and produces investigations that find nothing useful. Treating all insider activity as risk misses the rare but consequential intentional cases. The methodology asks the analyst to start with risk and escalate to threat only when the evidence supports it. Two boundaries on the vocabulary: the label is a hypothesis about intent, revisable as evidence arrives, and definitions vary — NIST’s insider-threat definition includes unwitting insiders, so calibrate to your organization’s usage. And whichever vocabulary applies, the label never delays response: confirmed harmful activity is contained and escalated on act, asset, and impact, with intent resolved in parallel.
Edward Snowden: when triage misses intent
Snowden’s actions at the NSA were not negligent errors. They were a deliberate, sophisticated insider threat. He had authorized access, knew the systems, and exfiltrated classified material over an extended period. Much of the activity rode legitimate admin access, but the public record shows it was not invisible: the bulk collection used web-crawler software whose volume was unusual enough to be flagged, he was questioned about it and deflected by citing his sysadmin duties, and he used a coworker’s PKI credentials to reach material beyond his own access. The signals existed; they were explained away.
The lesson for Subject: entity-based behavioral analytics that compared Snowden’s activity against his own historical profile, against peers in similar roles, and against the sensitivity of the data accessed could have produced earlier signals. Detection rules built around “is this normal in the environment” would not have. The methodology treats role + data sensitivity as a multiplier on every anomaly score; that multiplier is what surfaces sophisticated insiders.
A second case: the marketing team and the DLP workaround
An illustrative composite (the numbers are representative, not from a published incident): a marketing team unintentionally bypassed Data Loss Prevention controls by converting confidential documents into image files and sharing them externally with a client during a collaboration. The workaround inadvertently exposed records for 3,200 customers.
Investigation found no malicious intent. The behavior stemmed from frustration with secure file-sharing tools that added an average of 27 minutes to each transaction. The team was solving a usability problem, not stealing data.
The remediation focused on the underlying friction: the approved sharing workflow was redesigned to take 4 minutes per exchange (down from 27), and a tailored process was added for marketing’s specific collaboration needs. Compliance improved 92% within 30 days.
This is insider risk, not threat, and the label decided the lasting fix, not the immediate response: the exposure was scoped, contained, and run through the notification question before anyone weighed motive. With that handled, the investigation pivoted from forensics to process improvement. Treating it as threat would have produced an enforcement action that did not actually fix the cause.
The Insider Threat Matrix
The Insider Threat Matrix A public framework maintained at insiderthreatmatrix.org. Catalogs insider techniques across five sections (motive, means, preparation, infringement, anti-forensics) similar to how MITRE ATT&CK catalogs external adversary techniques. The matrix provides shared vocabulary and detection guidance. at insiderthreatmatrix.org organizes insider tradecraft into five sections. They are facets of a case, not a sequence an insider marches through. Used as a lens, the matrix gives analysts a vocabulary for describing what they are seeing.
🎯 Motive
Why an insider might act. Financial pressure, ideology, grievance, ego, coercion, or compromise by an external party. Rarely visible in telemetry; usually visible in human signals (HR concerns, expressed dissatisfaction, sudden lifestyle changes).
🛠️ Means
What access and capability the insider already has. The matrix catalogs the techniques an insider can use without ever needing to “hack in”, they are already inside.
🧭 Preparation
The steps an insider takes before the harmful action: reconnaissance of internal systems, acquisition of additional credentials, learning what the SOC watches. These are the early signals if anyone is looking.
⚠️ Infringement
The actual harmful action. Theft of intellectual property, sabotage, fraud, exfiltration. The visible event most investigations start from.
🧽 Anti-forensics
What the insider does to make the action hard to trace. Log clearing, timestomping, using accounts they should not (or accounts that “belong” to someone else). Cleanup is itself a signal.
Inside each section
Motivations the matrix catalogs
- Financial gain. Data theft or abuse of access for personal profit, often tied to fraud or IP theft. Triage correlates access to high-value assets with anomalous transfers or DLP violations, especially off-hours or to personal destinations.
- Coercion or blackmail. External pressure produces abrupt, high-risk actions inconsistent with User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. history. Sudden privilege escalations or sensitive access outside normal duties, often with concealment.
- Revenge or resentment. Triggered by demotions, conflicts, perceived mistreatment. Behavior changes after HR actions: unusual access, deletions, misconfigurations on critical systems.
- Curiosity or challenge. Non-malicious boundary testing by privileged users. Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. or unauthorized exploration; weigh against training environments.
- Ideological beliefs. Political or personal convictions producing data leaks or sabotage. Anonymization tools, external Data Staging Sensitive data collected and stored locally in chunks before exfiltration, avoiding large, sudden transfers that DLP would flag. , access aligned with the activism target.
- Negligence or apathy. Careless behavior creating risk through weak hygiene. Repeated policy violations or mishandled Sensitive Data Information that is confidential, proprietary, or regulated, such as personal data, financial information, or intellectual property. without clear malicious intent. This is risk territory, not threat.
Means the matrix evaluates
- Technical access. Beyond role-based access: residual permissions from previous teams, inherited group rights, lateral-movement paths via shared service accounts. Access path mapping surfaces dormant access that role review misses.
- Environmental awareness. Insiders can Exploit A technique or piece of code that turns a vulnerability into actual capability: remote code execution, privilege escalation, authentication bypass. A vulnerability without an exploit is theoretical; a vulnerability with one is operational. knowledge of internal processes, weak controls, or architectural blind spots. Tenure, cross-department experience, and access to internal documentation all increase environmental awareness.
- Privileged access. Admins and engineers bypass routine controls by design. Triage applies tighter scrutiny: unusual admin tool use, escalation paths, sensitive system access outside the job pattern.
- Physical access. Hardware tampering, offline Exfiltration The unauthorized transfer of data from a system or network, often as part of a data breach or espionage operation. via USB, planted rogue devices. Badge logs, USB Telemetry Collection and transmission of security-relevant data from remote sources for monitoring and analysis. , and secure-zone entry data belong in insider triage.
Preparation activity to watch for
- Technical prep. Penetration tools, encryption utilities, scripting platforms not normally required for the role. Often deployed in sandboxed or temporary directories. Monitor for unusual binary executions and failed installs from non-admin paths.
- Data gathering. Testing access to datasets outside job scope. Small sample downloads or probing archival stores that escalate in size and frequency. Sudden access to Legacy Systems Outdated technology or systems that remain in use, often with security vulnerabilities. or large non-recent datasets is a precursor.
- Temporal indicators. Preparation activity shifts to off-hours, weekends, holidays. These windows often coincide with reduced staffing. Alerting on high-sensitivity access during low-visibility hours surfaces this.
- Circumventing testing. Deliberate threshold-testing: failed logins, policy violations, copying data across classifications. Individual events look benign; the pattern over days or weeks is the signal.
Infringement: how harmful action actually happens
- Execution The attacker successfully runs malicious code on a system, typically using interpreters, scripts, payloads, or legitimate tools. patterns. Rather than one large action, insiders often spread access or extraction over days or weeks, staying below alert thresholds. Repeated small-scale transfers from sensitive systems are worth flagging even when each is under threshold.
- Technical execution. The staging pattern from Preparation matures here: the small test queries and sample downloads become extraction at volume. The transition point, sampling turning into bulk movement, is where the case stops being preparation and becomes the act.
- Compromised Credentials Usernames and passwords exposed, stolen, or leaked, enabling attackers to gain unauthorized access to systems or services. . “Borrowing” accounts from coworkers on vacation, leave, or recently departed. Usage of dormant or newly reactivated identities should be correlated against the original owner’s expected behavior.
- Supply Chain The network of organizations, people, activities, and resources involved in creating and delivering products, presenting multiple attack vectors for compromising systems or software during development and distribution. manipulation. Abusing access to development pipelines or procurement to insert malicious code or alter dependencies. Last-minute code changes by high-privilege users tied to change-control tickets and peer approvals.
Anti-forensics: how insiders try to hide
- Technical concealment. Deleting or truncating event logs, scrubbing shell history, tampering with audit trails, overwriting timestamps. Encryption tools or shred scripts deployed shortly after activity. Integrity validation on key forensic sources is the counter.
- Behavioral concealment. Working under assumed identities, manipulating ticketing systems, crafting business cases that look legitimate but cover malicious access. Authenticate business justifications against peer approvals and organizational objectives.
- Misdirection. Triggering low-impact security events to divert attention from the primary objective. Triage should ask whether simultaneous incidents are causally linked or part of a broader misdirection campaign.
- Counter- Intelligence Information gathered and analyzed to understand and predict potential security threats. . Monitoring SIEM alerts, Ticket The case record that tracks an alert or incident through investigation: who owns it, what was found, what verdict was reached, and when it was closed. In a SOC the ticket is both the unit of work in the queue and the documentation trail that escalation, metrics, and future investigations depend on. queues, or detection content to learn how the SOC operates. Compartmentalize investigative workflows and restrict access to Detection Logic The rule, model, or heuristic that decides whether a given input fires an alert. The logic that produced the alert matters as much as the alert it produced; two engines can name the same alert for very different reasons. .
What insider analysis catches
📦 Slow-burn data collection
An insider gradually building a personal cache of sensitive documents over months. Each individual access looks legitimate; the trajectory is the signal.
🚪 Access creep before a known event
Requesting or accumulating permissions in the weeks before a known departure, performance review, or organizational change. Correlation with HR signals is what surfaces this.
🪪 Shared-account misuse
A shared account being used by an unexpected person. Hard to detect because the audit trail is intentionally ambiguous. Behavioral baselining of the shared account against its expected users is the strongest approach.
🔇 Anti-forensic cleanup
Log clearing, history wiping, USB usage from an account that has never used removable media. Each is a signal in its own right; the combination is almost always intentional.
Behavioral vs technical indicators
The strongest insider triage correlates two streams that often live in separate teams: human signals (HR, manager observations) and technical signals (logs, telemetry). Correlated, they sharpen the risk-versus-threat label — and only the label; response rides on act, asset, and impact, never on the streams agreeing.
Behavioral indicators
- Expressed dissatisfaction. Verbal resentment toward management, policy changes, or peers. Worth investigating in context of recent disciplinary or organizational changes.
- Sudden withdrawal. Shift toward isolation, minimal communication, refusal of collaborative work. Worth correlating against technical anomalies in the same window.
- Unusual curiosity. Repeated questioning about systems, data classification, or infrastructure outside the user’s role. Cross-reference with access logs.
- Schedule changes. Voluntary shifts to nights, early mornings, weekends without business justification, especially when paired with sensitive system access.
- Resistance to oversight. Arguing against monitoring tools, complaining about controls, or circumventing security steps. Concerning if paired with technical attempts to disable controls.
- Performance degradation. A decline after being passed over for a role or project. Risk-taking or careless access behavior shortly after is worth noting in triage urgency.
- Personal stressors. Major life events (divorce, debt, medical) can lead to risky decisions. Do not assume intent, but note the compounding pressure.
Technical indicators
- Unauthorized data transfer tools. FTP clients, external sync utilities, USB mass storage on accounts that have not used them historically.
- Low-volume data exports just below alert thresholds. Extracting moderate amounts over extended periods is a known evasion tactic. Look for staying-below-threshold patterns.
- Privilege bypass attempts. Multiple failed access attempts to restricted systems, or self-approval of elevated permissions.
- Compression and archiving outside normal workflows. Zip, tar, or rar files containing sensitive documents in personal folders or shared drives.
- Disabling endpoint protections. Turning off antivirus, DLP agents, or logging services. Treat as high-priority and possibly isolate for forensic review.
- Accessing dormant accounts or unrelated systems. Reactivating dormant credentials, touching systems unrelated to current responsibilities.
- Use of anonymizing or encrypted services. Remote desktop sessions, encrypted messengers, unsanctioned cloud storage. Cross-reference with network and endpoint telemetry.
Correlation sharpens the label; harm triggers the response
Technical signals without behavioral context produce benign fires (admins legitimately disable agents, developers legitimately use scripting tools — correct detections of authorized behavior). Behavioral signals without technical context produce HR friction (someone is having a bad month and the SOC opens an investigation). Correlating the two streams is how the label gets sharper: risk versus threat, mistake versus intent. The label never gates the response. The moment technical evidence confirms harmful activity — data leaving, controls disabled, evidence destroyed, sabotage in motion — the case escalates on act, asset, and impact under the standard escalation criteria, whether or not any behavioral signal exists, and containment does not wait for HR context. Motive gets investigated in parallel by the people authorized to hold it. The two-stream rule governs the opposite direction: behavioral signals alone, without technical corroboration, never open an enforcement case.
Guardrails: the analyst investigates activity, not people
Three rules keep insider analysis defensible. First, presumption of innocence: the SOC does not collect behavioral signals like the list above. They reach the analyst through an HR or manager referral, and the analyst’s job is to check whether technical evidence corroborates the referral, not to build a case against a person. Second, document observable facts only: “account jsmith transferred 4.2 GB to an unrecognized external IP at 02:14” survives legal review; “Jane is probably stealing data before she quits” is defamation and employment-law exposure the moment it enters a ticket. Third, mind the base rate: genuine insider threat is rare, and broad indicator lists like these mostly describe innocent people having a hard month. Any single indicator, and most pairs of them, will overwhelmingly flag employees who have done nothing wrong. An indicator justifies looking at telemetry. It never justifies a conclusion.
Mitigation strategies
Building mitigations is not Subject-phase work; it is the insider program, owned by security leadership with HR and legal, and it exists before and after any single case. The five practices are included because the analyst triages inside them: each one is both a control the program builds and a signal source the analyst reads (an access attempt outside current scope, a segregation-of-duties violation, an HR referral). Read the first sentence of each card as the program’s job and the last as yours.
Least privilege enforcement
Users have access to data and systems required for current job, with automated deprovisioning of stale roles or inherited access. Triage flags access attempts outside current scope. Role-based reviews integrate into quarterly compliance and into alert suppression logic.
Segregation of duties
No individual can create, approve, and execute sensitive actions on their own. Deployment, access grants, and audit log review live with separate roles. Triage treats violations of this model (especially with emergency access or after hours) as high-risk.
Technical monitoring
Behavioral analytics, privileged session monitoring, endpoint detection tuned for lateral movement and data aggregation. Quality alerts come from individual baselines, not just global policy violations. Triage prioritizes events that combine anomalous behavior with elevated privilege.
Cultural approaches
Employees feel safe reporting concerns through clear, non-retaliatory channels. The security culture surfaces early warnings before they become technical events. Triage considers HR referrals and social signals alongside log data.
Insider response protocols
Dedicated playbooks for internal actors: evidence preservation without tipping the subject, coordinated containment, post-event review. Mature programs maintain specialized insider threat cells separate from standard incident response.
Insider investigations need different escalation
An insider investigation is one of the few in triage where the analyst should usually not directly engage the subject. Coordinate with HR and legal before the subject becomes aware they are being investigated. Premature exposure can compromise both the security investigation and any subsequent legal action.
Employee privacy is a hard constraint, not a courtesy
Insider investigations run inside an envelope of employment and privacy law that varies by jurisdiction. In much of the EU, works councils must be consulted before employee monitoring is deployed or expanded, and GDPR demands proportionality: the least invasive measure that answers the specific question, not a general trawl through a person’s digital life. Several US states (Connecticut, Delaware, and New York among them) require notice of employee monitoring. Practically, that means one thing at triage speed: before widening collection on a named person, confirm with legal that the collection is authorized for that purpose, and pull only what the question requires. Evidence gathered outside the envelope can be unusable in any disciplinary or legal proceeding and can turn the organization from investigator into defendant.
Key Takeaway
Insider analysis is the fourth pillar of Subject and the one most likely to involve people outside the SOC. The methodology applies the same four dimensions but with adjusted expectations and a different escalation path. Start with risk; move the label to threat only with evidence. Confirmed harm responds on act, asset, and impact under either label.
Next up
Subject working example
A multi-step walkthrough applying Subject analysis to a real-shaped scenario.
See the working example