WorkAuditor Blog

What does insider threat detection look like when it works? It looks like a baseline. The firms that catch insiders early compare activity to a normal pattern; everyone else waits for a personality change that never arrives in a form anyone can act on. A fintech client called me after a contract developer left, and the six months of activity logs told the whole story: 1,900 files pulled from the source repository, mostly between 2 a.m. and 5 a.m., in batches of 50 to 150, all of it concentrated in his final two weeks. The tell wasn't attitude. The tell was a pattern the company already had the data to see.

Insider threat detection signs worth acting on

Here is what I look for, in order of how often it shows up in confirmed cases:

• Bulk downloads outside business hours, especially in the final weeks before departure.
• Files copied to removable media or personal storage accounts for the first time ever.
• Printing activity that spikes for documents the employee has never printed before.
• Access to folders outside the person's role — data they never needed, opened suddenly.
• Renaming or compressing files, which is how people prepare data to move past review.
• Unexplained local copies of shared files that should have stayed in the repository.

None of these is proof alone. An auditor's after-midnight download might be a deadline. The value is in the combination and the frequency.

The signs only matter if you have a baseline

Insider threat detection is a statistics problem, not a psychology problem. If you don't know what "normal" looks like for each role, you cannot recognize the anomaly. Build baselines per role: typical file volume, typical hours, typical tools. One client found that an admin in accounts payable had never opened a folder containing purchase orders — ever — in eighteen months. When that folder started being opened daily, the alert was immediate. Baselines don't need machine learning; a quarterly table of averages per role is enough to start.

Insider threat detection solutions: alerts, not wall-to-wall surveillance

The solution that works is targeted alerting: thresholds on download volume, off-hours activity, removable media use, and personal-cloud uploads. Escalate to broader monitoring only for at-risk roles — finance, sales, engineering, and anyone with access to client data. In the fintech case above, the tell was a threshold: the developer's largest single-day download before his final weeks was 12 files. A simple alert at "50 files in a session" would have flagged him on day one of the exfiltration window instead of at the lawyer's letter stage.

Disgruntlement is a process problem before it's a security problem

When a resignation is announced, treat the notice period as an elevated-risk window by default. A client in manufacturing lost a process diagram to a personal email two days after a manager learned his role was being cut. The manager wasn't a criminal; he was protecting his leverage for the job search. Fix the process, not the person: revoke access at notice, move the person's deliverables under review, and put a shorter leash on data access during the exit window. Most insider threat detection programs die because they try to detect emotions instead of structuring access.

Detection is a cultural program

The quietest insider threats are the ones nobody reports. Employees who see a colleague copying files at 3 a.m. usually say nothing because they don't know the company wants to know. State plainly, in your security policy and in onboarding, that suspicious file activity should be reported internally and that reports are handled confidentially. One logistics client recovered a customer database export because a teammate noticed and spoke up — no tool involved.

Tune the alerts before they tune you

False positives are the silent killer of insider threat detection programs. A program that fires forty alerts a day gets muted within a month; one that fires three gets read. Start with generous thresholds, run for two weeks, and calibrate against reality: every alert should end in a decision — investigated, dismissed, or escalated — and the dismissed ones tell you where the thresholds are wrong. At the fintech client, the calibration pass cut alert volume by 80 percent while keeping the signals that mattered, because the baseline data already existed. Noise is a tuning problem, not a reason to abandon the program.

If you can't answer what one of your employees downloaded last week, you don't have an insider threat detection program yet; you have a hope. A good place to start is visibility: WorkAuditor is cloud-based employee monitoring software for Windows and Mac that logs file activity, application use, and device behavior in one place. See what it tracks at https://www.workauditor.com.