M ManySignal

Guide · ManySignal

Insider Threat Program Guide

Insider threat programs fail when they focus on data controls without behavioural context, or on behavioural monitoring without HR integration. This guide covers the operating model: what to monitor, how to integrate with HR, how to keep the program compliant with privacy law, and how to distinguish disgruntlement from active exfiltration.

EN Elena Novak — Co-founder & CTO, ManySignal
15 min read Published Jun 27, 2026 Download PDF
01

The three insider categories

Insider threats break into three categories: malicious (intentional exfiltration or sabotage), negligent (accidental exposure via misuse of tools), and compromised (external attacker using insider credentials). The detection stack for each is different and the response is different — a compromised insider needs credential rotation; a malicious insider needs an investigation, not a session revoke.

The behavioural signals overlap. What separates them is context: HR status changes, access changes, and communication patterns. This is why the program must include HR data — otherwise you're detecting shadows.

02

HR-driven baselines and triggers

Consume HR events via a Workday/BambooHR/Rippling connector: departures (notice given, termination effective, exit interview), role changes, PIP status, comp cycle. These become tags on the identity in the entity graph.

Departures are the highest-signal trigger. A user on notice who suddenly reads from a data warehouse they've never touched is the textbook case. The behavioural detection fires with elevated weight because the HR context multiplies the signal.

03

Behavioural signals that actually work

Effective insider detections combine three or more signals: (1) volume anomaly on data access, (2) atypical target (data they never touched), (3) atypical channel (personal device, uncommon SaaS export), (4) atypical time (weekend/off-hours), (5) HR context (notice given, PIP).

One signal alone is noise. Two is worth watching. Three or more with matching HR context is a case worth opening.

# detections/insider/departure_bulk_export.yaml
key: insider.departure_bulk_export
type: behavioural+correlation+graph
where:
  class_uid: 6003
  activity: download
correlate:
  window: 24h
  group_by: identity_id
  sequence: ["download*20"]
behavioural:
  dimensions: [temporal, access_surface, volume]
  min_joint_score: 70
graph:
  condition: identity_on_departure_notice
severity: high
04

Response without breaking trust

Never fire a containment action on an insider case autonomously. The false-positive impact is career-damaging. Every insider case goes through a two-person review — usually an analyst + a manager or HR partner.

Standard actions: preserve evidence (immutable snapshot of activity), revoke access to sensitive systems, notify HR/legal. Containment beyond that (device seizure, formal HR action) is out of scope for the SOC.

05

Privacy and program governance

Publish the monitoring policy internally. Employees should know what is monitored, why, and by whom. Opaque programs are correctly resented and legally fragile.

Audit access to insider cases. The insider case queue is one of the most privacy-sensitive datasets in the enterprise; treat access to it as a privileged action logged at the same tier as production database access.

Key takeaways

  • Three insider categories: malicious, negligent, compromised. Different responses.
  • HR context multiplies the signal — integrate the HR connector early.
  • Effective detections combine 3+ signals with HR trigger.
  • Never autonomous containment on insider cases. Two-person review always.
  • Publish the monitoring policy internally. Audit access to the case queue.

Further reading

Frequently asked questions

What is Insider Threat Program Guide in an agentic SOC?

Insider Threat Program Guide is part of ManySignal's agentic SOC and MDR platform, where AI agents detect, triage, investigate, and respond to threats with human-governed autonomy.

How does ManySignal handle insider threat program guide?

ManySignal grounds insider threat program guide in a temporal entity graph and behavioural baselines, so every verdict is backed by auditable evidence rather than opaque scores.

Can ManySignal replace my SOAR or MDR for insider threat program guide?

Yes. ManySignal combines detection, triage, investigation, response, and reporting in one platform, and can operate as your MDR or augment an existing SOC team.

How is autonomy governed?

Through an autonomy ladder: recommend-only, approve-gated, and autonomous modes per action class, with dry-run previews, blast-radius limits, and a one-click tenant kill switch.

How fast is time to value?

Declarative connectors and shipped detections typically produce AI agent verdicts on live alerts within days, not quarters — no parsing projects or playbook-building phase.

Is ManySignal available as a managed service?

Yes. Consume ManySignal as MDR with 24/7 coverage and monthly reporting, run it as your in-house agentic SOC, or use it as the platform behind your own MDR practice.

How does ManySignal license the platform?

Pricing scales with protected assets and autonomy tier, not per-GB ingestion or per-alert volume. Starter, Growth, and Enterprise plans are available; MDR providers receive volume discounts for multi-tenant deployments.

Where does our data reside?

By default in AWS us-east-1. Enterprise tenants can pin data to specific AWS regions, deploy self-hosted on their own Kubernetes cluster, or use customer-managed encryption keys (CMK) to retain cryptographic control.

What does the evidence trail contain?

Each verdict stores the full question set, per-question agent answers, confidence weights, source event references, entity graph snapshots, and operator attestation — preserved immutably for the retention period chosen at contract time.

How does ManySignal handle a false-positive alert?

The triage agent auto-closes findings it assesses as false positives with a documented rationale — which rule fired, why the evidence fails to support escalation, and the entity baseline that informed the decision. Auto-closure rates typically reach 85–95% within 90 days as baselines mature.

Continue reading

See the agentic SOC in action

Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.