Insider Threat Indicators Most Companies Miss

A regional professional services firm spent four years building a client list that produced eighty percent of its revenue. The list left through email on a Tuesday afternoon. A senior account director copied it to a personal cloud account, took accrued vacation, and never came back. The firm found out six weeks later when two of its larger clients mentioned, almost in passing, that they had been pitched by a new shop with a strangely accurate read on their internal politics.

Nothing about the exit triggered an alert. No malware, no off-hours bulk download, no DLP signature, no anomalous endpoint. The departing employee used the access she had always had, in the way she had always used it, on a date that fell well within ordinary patterns. The technical posture saw nothing because there was nothing technical to see.

That story is not unusual. It is the shape of most modern insider incidents, and it points to a problem that compliance programs and security tooling were never designed to solve.

Why Companies See Insider Threats Late, or Never

Outside attackers leave fingerprints. Insider actors leave habits. The architecture of corporate trust assumes that authorized users acting within their authorizations are not a meaningful risk, and the entire detection stack is built on top of that assumption. SIEMs alert on volume. Endpoint agents alert on novelty. Identity tools alert on geography. None of these fire on a known person doing a familiar thing on a familiar device.

The ACFE Report to the Nations has tracked occupational fraud across hundreds of organizations for more than two decades. The headline statistic almost never moves. Roughly half of cases are discovered through tip rather than control. Median duration before discovery sits between twelve and eighteen months. Median loss runs into six figures. The numbers are stable because the detection model is stable, and the detection model is structurally unable to see most of what is happening.

And the people inside the model know it. A trusted insider with a working understanding of how their own monitoring works will operate in the seams. The seams are where behavioral indicators live.

The Behavioral Indicators Auditors Don’t Track

A meaningful insider risk signal is rarely a single event. It is a cluster of small things that, taken together, reshape a person’s relationship to the organization in ways that ordinary management does not register.

Access scope creep is the first. Roles change, projects rotate, but permissions only ever accumulate. A department head ends up with read access to systems she has not actually used in two years. The risk does not come from the original grant. It comes from the day she has reason to use it again, with no audit attached.

Vacation aversion is the second. Anti-fraud researchers have written about this for forty years for the same reason banks rotate trading desks: most embezzlement schemes require ongoing presence. A senior person who refuses to take any meaningful time away, who works through illness, who handles every reconciliation personally, is signaling something. Sometimes it is dedication. Sometimes it is exposure.

Lifestyle drift not matched by visible income is a third. The vehicle, the second home, the timing of a child’s private school enrollment. None of it is conclusive. None of it is irrelevant either. Investigators have seen the same pattern enough times to take it seriously.

After-hours access without operational purpose is a fourth. Most professionals have rhythms. When the rhythm shifts, and the new rhythm includes systems that the role does not require, that is a thread.

And then there is the language. People who are negotiating a parallel arrangement, or moving toward one, sound different in writing. Explanations get longer. Routine items acquire elaborate justifications. Direct questions get answers that talk around them. Anybody who has read enough internal email can hear it.

Each indicator alone is meaningless. The cluster, in time, is the case.

Where Compliance Programs Stop Looking

Most insider threat programs that exist on paper are HR documents stapled to an information security policy. They satisfy a regulator. They do not run a query that joins HR data, access logs, and finance records, because those three data sets live in three different reporting lines and nobody has the political authority to pull them together.

That separation is not accidental. Each function has good reasons not to share. HR carries privacy obligations. IT does not want to be in the personnel business. Finance has its own controls and resents the implication that they are insufficient. The result is that the indicators sit in three different drawers, each visible only to people who cannot, by themselves, see the whole pattern.

Corporate intelligence work earns its keep here, in the gap. Pulling those drawers together, under counsel privilege, with a narrowly scoped objective, is the only way to test whether a real threat exists or whether the cluster is coincidence. Business intelligence is not a dashboard problem when the data sources will not even speak to each other.

What an Investigation Actually Tests

When an executive team brings us in after a suspected insider incident, the first request is almost always for a forensic image. That is rarely the right starting point. Forensics tells you what a device did. It does not tell you why, who else is involved, or whether what you found is the full picture or the visible edge of something larger.

The work is corroboration. We look for whether the behavioral indicators line up across data sources that the subject does not control. Did the access events match the timing of unusual financial activity, even small-dollar persistent activity below the typical alerting threshold? Is there a counterparty on the receiving end of the suspected exfiltration, and does that counterparty have a relationship to the subject that predates the incident? When peer behavior is mapped against the subject’s behavior, does the subject look like an outlier, or is the team simply working long hours?

A single suspicious behavior is a coincidence. Two that converge in time and counterparty are a thread. Three with a paper trail are a case. Investigative consulting is, at its core, the discipline of building a case rather than reacting to a hunch.

The discipline cuts both ways. Many investigations end with a finding that the cluster is real but explainable. A senior person was working long hours because of a sick parent. The vehicle was leased through a family LLC. The vendor relationship preceded the engagement. Knowing what is not happening is its own product.

Why Background Checks Are a Floor, Not a Ceiling

Pre-employment vetting catches the obvious. It does not catch the long arc of an insider who has been clean for fifteen years and is now working through a divorce, a medical event, or a financial decision that has narrowed the available options. Background checks for executives, vendors, and partners are necessary and structurally insufficient, both at once.

The harder question is what an organization is doing twelve, thirty-six, sixty months after hire to keep its understanding of high-trust roles current. CISA’s insider threat mitigation guidance and the FBI’s insider threat overview both lean on the same idea. The vetting is continuous, not transactional, and the framework has to live somewhere.

Building an Inside View Without Becoming a Surveillance Apparatus

Most leadership teams react to insider risk with one of two failures. Some overcorrect into a surveillance posture that produces a thousand false positives, exhausts the security team, and damages internal trust to the point that the best people leave. Others under-correct into willful blindness, treating any examination of trusted insiders as an insult to the culture. Both produce the same outcome on a long enough timeline.

The middle path is procedural rather than technological. Pre-employment vetting that goes beyond a criminal records check. Mandatory vacation for anyone whose role gives them control over funds, sensitive data, or vendor selection. Periodic reaccreditation of access for senior roles, with a hard line on permission accumulation. A named, quiet, well-resourced owner of insider risk who reports outside the line of business he is examining. The line between corporate intelligence and surveillance is procedural, not technical, and it has to be drawn deliberately.

And the cultural piece. The organizations that handle this best treat insider risk the way mature engineering teams treat safety. Not as a finger-pointing apparatus, but as a property of the system that everyone has a stake in keeping intact. They make it easy to report concerns without consequence. They rotate roles where rotation is feasible. They build redundancy into critical processes so that no single person carries an unauditable function.

The point is not to catch traitors. The point is to remove the frictionless environment where small behaviors compound into incidents that nobody noticed until the client list left on a Tuesday afternoon.

What This Looks Like in Practice

An executive who reads this and recognizes one of the indicators in someone on her team has a problem and an opportunity, in roughly that order. The problem is that any direct confrontation, mishandled, will either tip off the subject or expose the company to legal risk if the suspicion turns out to be wrong. The opportunity is that early, quiet, well-scoped intelligence work can produce clarity in weeks rather than the eighteen-month median the ACFE has been tracking for a generation.

The right starting point is rarely the IT department or the auditor. It is counsel and an outside investigator working under privilege, with a narrow scope, against a defined set of indicators. From there, the path either expands into a documented case or contracts into a clear no-finding that lets the organization move forward without the cloud.

Either outcome is preferable to letting the cluster sit unexamined.

Brett Maternowski runs Florida Man Innovations, where the work is building and growing revenue systems that hold up under pressure, and Farsight Intelligence, where the work is finding what you need to know before it finds you. For executives, attorneys, or boards facing an insider risk question that needs quiet, rigorous attention, schedule time at meet.brettfl.com or write directly to [email protected].