The three insider categories
Insider threats break into three categories: malicious (intentional exfiltration or sabotage), negligent (accidental exposure via misuse of tools), and compromised (external attacker using insider credentials). The detection stack for each is different and the response is different — a compromised insider needs credential rotation; a malicious insider needs an investigation, not a session revoke.
The behavioural signals overlap. What separates them is context: HR status changes, access changes, and communication patterns. This is why the program must include HR data — otherwise you're detecting shadows.
HR-driven baselines and triggers
Consume HR events via a Workday/BambooHR/Rippling connector: departures (notice given, termination effective, exit interview), role changes, PIP status, comp cycle. These become tags on the identity in the entity graph.
Departures are the highest-signal trigger. A user on notice who suddenly reads from a data warehouse they've never touched is the textbook case. The behavioural detection fires with elevated weight because the HR context multiplies the signal.
Behavioural signals that actually work
Effective insider detections combine three or more signals: (1) volume anomaly on data access, (2) atypical target (data they never touched), (3) atypical channel (personal device, uncommon SaaS export), (4) atypical time (weekend/off-hours), (5) HR context (notice given, PIP).
One signal alone is noise. Two is worth watching. Three or more with matching HR context is a case worth opening.
# detections/insider/departure_bulk_export.yaml
key: insider.departure_bulk_export
type: behavioural+correlation+graph
where:
class_uid: 6003
activity: download
correlate:
window: 24h
group_by: identity_id
sequence: ["download*20"]
behavioural:
dimensions: [temporal, access_surface, volume]
min_joint_score: 70
graph:
condition: identity_on_departure_notice
severity: high
Response without breaking trust
Never fire a containment action on an insider case autonomously. The false-positive impact is career-damaging. Every insider case goes through a two-person review — usually an analyst + a manager or HR partner.
Standard actions: preserve evidence (immutable snapshot of activity), revoke access to sensitive systems, notify HR/legal. Containment beyond that (device seizure, formal HR action) is out of scope for the SOC.
Privacy and program governance
Publish the monitoring policy internally. Employees should know what is monitored, why, and by whom. Opaque programs are correctly resented and legally fragile.
Audit access to insider cases. The insider case queue is one of the most privacy-sensitive datasets in the enterprise; treat access to it as a privileged action logged at the same tier as production database access.
Key takeaways
- Three insider categories: malicious, negligent, compromised. Different responses.
- HR context multiplies the signal — integrate the HR connector early.
- Effective detections combine 3+ signals with HR trigger.
- Never autonomous containment on insider cases. Two-person review always.
- Publish the monitoring policy internally. Audit access to the case queue.