# Insider Threat Management: Connecting the Dots Before an Incident

An episode of [All Things Internal Audit](https://invisiblenetwork.ai/podcast/1758983201), 8 Sep 2026, 34 min.

Audio: https://traffic.libsyn.com/secure/1984d534-f92f-4772-a722-6ac47400e67e/ATIA_-_Sanjay_and_Yvette_with_Ad.mp3?dest-id=3677289

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Sanjay Vadlamani talks with Yvette Adams about how insider threats extend beyond malicious employees. They discuss negligent, malicious, and compromised insiders, along with the ways AI, remote work, cloud applications, and expanding access have increased organizational risk. The conversation also covers behavior monitoring, employee privacy, access management, offboarding, multidisciplinary risk teams, and the importance of connecting information across organizational silos before a threat becomes an incident. • HOST: • Sanjay Vadlamani, CIA, CISA, CRISC Senior Manager, Internal Audit, PayJoy • GUEST: • Yvette Adams, CIA, CRMA Director of Enterprise Risk Management, Zions Bancorporation KEY POINTS: • Introduction \[00:00–00:00:38\] • The Three Types of Insider Threats \[00:00:39–00:03:19\] • How AI, Remote Work, and Cloud Applications Increase Risk \[00:03:20–00:06:52\] • IIA Membership \[00:06:53–00:07:38\] • Balancing Employee Monitoring, Privacy, and Trust \[00:07:39–00:11:13\] • Indicators of Insider Risk \[00:11:14–00:15:16\] • The FinWise Bank Incident and Offboarding Risk \[00:15:17–00:18:48\] • Connecting Information Across Organizational Silos \[00:18:49–00:22:47\] • Five Elements of a Mature Insider Risk Program \[00:22:48–00:26:40\] • Lessons From the Tesla Insider Threat Case \[00:26:41–00:28:56\] • Understanding the Insider Threat Life Cycle \[00:28:57–00:30:07\] • Employee Self-Reporting and Where Organizations Should Start \[00:30:08–00:33:40\] • Closing \[00:33:41–00:33:51\] IIA RELATED CONTENT: Interested in this topic? Visit the links below for more resources: • Global Practice Guide: Auditing Insider Threat Programs • Insider Threat Leading Practices • Insider Threat Assessment Using NIST Cybersecurity Framework • All Things Internal Audit Tech: Identity & Access Management • Understanding Insider Threats • IIA Membership Visit The IIA's website or YouTube channel for related topics and more. Follow All Things Internal Audit: Apple Podcasts Spotify Libsyn Deezer

## Transcript

[0:02] The Institute of Internal Auditors presents All Things Internal Audit.
[0:06] In this episode, Sanjay Vadlamani talks with Yvette Adams about how insider threats
[0:10] extend beyond malicious employees.
[0:14] They discuss negligent, malicious, and compromised insiders, along with ways AI,
[0:19] remote work, cloud applications, and expanding access have increased organizational
[0:24] risk. The conversation also covers monitoring, employee privacy, access
[0:30] management, and the importance of connecting information across organizational
[0:35] silos before a threat becomes an incident.
[0:39] Hi, Yvette. Thanks so much for joining.
[0:41] Looking forward to this discussion on insider threat management.
[0:45] Pleasure to be here, Sanjay. I've been looking forward to this.
[0:48] When people hear the term insider threat, they often think of a malicious
[0:54] employee stealing data. But in practice, what types of insider threats are
[1:00] organizations dealing with, from your perspective, most frequently today?
[1:04] I do think it's common that people will usually picture a disgruntled employee who
[1:09] is intentionally stealing data before walking out the door.
[1:13] And while that does happen, while it is something that does occur, it's actually
[1:17] not the most common. The most common would be the negligent insider.
[1:22] There are three classes of insiders.
[1:24] The first is the negligent insider, which is the most common, as I said.
[1:28] Then you've got the malicious insider, and then you've got the compromised insider.
[1:33] So to give you some definition around that, a negligent insider is somebody who
[1:38] accidentally emails sensitive information to the wrong person, or they accidentally
[1:43] misconfigure a cloud environment, or they upload confidential information to an
[1:48] unauthorized AI tool. So it's not intentional, it's accidental.
[1:54] The malicious insider, which is where most of our brains will go, is the individual
[2:00] who intentionally steals information. They're out there to commit fraud.
[2:04] They sabotage systems. They misuse the access that they've been granted.
[2:09] And then the third is the compromised insider.
[2:12] So that's when an external attacker gains access through stolen credentials, and
[2:18] they essentially operate within the environment using a legitimate employee's
[2:22] identity.
[2:24] And so just following up on the compromised, that would be a great example would be
[2:28] within cyber of a phishing attack.
[2:30] That's right. They've gained access through phishing, getting credentials.
[2:34] Sometimes they even call it spear phishing because they've got some information
[2:38] about you, and they'll ask you pointed questions that will get you to answer things
[2:42] that you wouldn't normally respond.
[2:44] And now they have information where they can access information using additional
[2:48] information that they wouldn't normally have.
[2:50] It's so funny you say that. At Payjoy, there was an audio of our
[2:56] CEO having his voice sent to people in AP saying, "This
[3:01] invoice is 90 days past due, and it should be paid," or 180.
[3:06] It was something that was really big, and the person could have freaked out, but
[3:11] thank God didn't. The sophistication is going areas that I had never imagined.
[3:16] So I totally agree.
[3:19] Absolutely.
[3:20] From your perspective, why are insider threats becoming a bigger concern for
[3:26] organizations? And then, what changes have you specifically
[3:32] seen in the workplace in your professional career?
[3:36] And as technology has evolved, how is this contributing to the risk for
[3:42] organizations?
[3:43] The first thing that has elevated it, you just hit on, AI.
[3:48] AI has introduced new risk paths. So employees can, first of all,
[3:53] unintentionally expose information or proprietary data to artificial intelligence
[3:59] that's not protected. And artificial intelligence can be used for voice mimicking
[4:05] and that kind of thing. So that has absolutely changed it.
[4:08] We also have a bigger attack surface than we have had historically.
[4:13] You've got hybrid and remote workers who have expanded their organizational
[4:19] boundaries in which they work. So people are no longer accessing data within the
[4:25] confines of a building that they work in, corporate offices on company-owned
[4:30] devices. They might be accessing information from homes, airports, personal
[4:35] devices, cloud environments. So that creates an additional layer of challenge.
[4:41] And then you have, like I said, the enormous amount of cloud applications
[4:47] and collaboration tools. So information will move much more freely now, which is
[4:52] great for productivity. However, it also makes data exfiltration easier than
[4:58] ever. So I would say leading organizations manage this
[5:04] threat alongside how the threat has changed.
[5:08] So historically, you would've seen programs that are heavily security-led and
[5:14] reactive, whereas today, I would say mature organizations are taking a
[5:20] multidisciplinary approach and coordinating insider risk programs.
[5:26] So you're bringing together programs in areas such as security,
[5:32] HR, legal, compliance, privacy, physical security,
[5:38] risk management to handle it from a lot of different angles.
[5:42] They'll broaden the scope from just malicious intent, because as we said,
[5:48] it's the negligent insider that is more common.
[5:52] And instead of saying, "Who's trying to steal our data?" They'll say, "Who has
[5:57] elevated risk conditions and access that could lead to loss?" So this might include
[6:03] people with excessive permissions. Or do you see unusual data movement?
[6:08] Are employees stressed? Are there contracts or contractors that are nearing
[6:13] off-boarding? Could we have compromised credentials or policy exceptions?
[6:17] I would say another shift is that people are starting to use more of behavior
[6:22] analytics. So organizations are looking for unusual patterns.
[6:27] That could include large downloads, abnormal access times to information,
[6:33] attempts to access systems that they don't have a responsibility, their job
[6:37] wouldn't require them to access that information.
[6:40] And then you have a system that is monitoring for these things, and then you layer
[6:45] on the human person to review those signals and see if there's areas of concern
[6:51] where maybe they should dive deeper.
[6:53] Yvette just described insider risk as a coordination problem.
[6:57] Security, HR, legal, privacy, and audit reading the same signals and
[7:03] judging together what they mean. That capability sits across a function, not one
[7:07] person. Building that judgment across a whole team is a leadership job.
[7:12] IIA membership helps you build that capability across your team with trusted
[7:16] standards, practical expertise, and a global community helping your people stay
[7:21] ready as AI and expanding access reshape the work.
[7:25] Explore everything now included with IIA membership at ii-a.org. Lead what's next.
[7:31] Now back to Sanjay and Yvette on monitoring, privacy, and where the line sits.
[7:40] I agree with everything you said. I'll just ask two questions.
[7:45] One, do you think in everything you said and with AI and elevated
[7:51] access roles, compromised people, behavioral tendencies with workers,
[7:58] that tools like maybe a Netskope should be used?
[8:02] And the second part of the question is, or any kind of third-party tool.
[8:06] And the second part of the question to me is, this is something that I'm always
[8:10] worried about is, yes, I understand companies will be looking at monitoring
[8:16] your downloads for
[8:19] exactly like you said. But it could be a slippery slope, meaning that they then
[8:25] go to keyboard type of the big brother.
[8:30] I totally am on board. I follow, and I am using a USB
[8:36] stick. The OpenAI guys from Apple downloaded, they
[8:42] said, a terabyte of data to exactly like you said.
[8:46] It was a cloud-based application. The guy had left.
[8:50] He realized his credentials were still active, swapped in his USB,
[8:56] voila, he has it. Goes to OpenAI and says, "Voila, here's our starting point for
[9:01] our product." But I don't know what the solution is. What's your thoughts?
[9:06] So on your first question, tools I would say absolutely consider what tools you can
[9:11] use based on the complexity of your organization, the type of information you have.
[9:16] You should absolutely be investigating what type of tools would work for you.
[9:21] I think that it's a fair question to say, "Are we invading people's privacy?" And
[9:25] as a company, you have to determine where is that line.
[9:29] I think it could vary depending on what company you have and what kind of
[9:33] information you have access to, and how proprietary is it, how protected is it,
[9:39] that kind of thing. But then also consider if you don't want to
[9:44] risk not protecting information at the risk of offending somebody
[9:50] to say, "We're employing you, and we need to make sure that the data is protected.
[9:55] And sorry, we have to do this," sort of thing.
[9:58] What I have seen is that companies will give a notice to their employees
[10:04] upon onboarding, and then also regularly, whether that's annually,
[10:10] to remind employees, "This is what you can do with data.
[10:14] This is how it should be stored." And they're very transparent about how they would
[10:19] be monitoring appropriate use. So it doesn't come as a surprise to employees
[10:25] that the way that they're using data is being monitored.
[10:29] That could control the risk of people wanting to download and having that
[10:35] pull to download data that they shouldn't be accessing anyway.
[10:38] You summed that up, I think, perfectly.
[10:41] And I'll say this, this is from the enterprise risk management, which has the view
[10:46] of the macro view of the company. Your response was exactly that.
[10:51] I think what you just said could apply to, from your perspective, a bank
[10:57] where I am a fintech insurance. To any kind of company,
[11:03] it comes down to communication and alignment and being transparent.
[11:08] You hit on everything. So I really, really, really appreciate that.
[11:13] It resonates with me. Going on, just following up on this, organizations,
[11:19] I think, often have this focus on
[11:24] external attackers, and we've talked about there's other types.
[11:30] But we're talking about insider threats, and I think this is
[11:35] kind of not as a big focus, but in your perspective, in your experience, how do you
[11:41] think leading organizations, what would their approach be regarding insider threat
[11:47] management? And have you seen a change in your experience from when you started to
[11:53] now on how companies are approaching this?
[11:56] So I would say the best insider threat indicators don't necessarily
[12:02] attempt to predict bad people. They look to identify areas of concentration of
[12:07] trust, access, and behavior that increases the likelihood of
[12:13] loss, and what the impact would be of that insider threat.
[12:17] So an organization should consider indicators and monitoring things
[12:23] that would measure things like exposure, behavior, control
[12:28] effectiveness, outcome. So some examples that go along with that,
[12:34] exposure. Things that you could monitor would be the percent of users with
[12:39] privileged access, the number of dormant accounts you might have, the number of
[12:44] emergency access grants that are given.
[12:48] In terms of behavior, you could monitor unusual large downloads that isn't
[12:53] commensurate with the person's job, access outside of normal work hours,
[13:00] repeated access failures when somebody is trying to access information, the use of
[13:06] unauthorized storage devices, like you said, a USB stick, or attempts to bypass any
[13:10] security controls. So again, those are things that you can monitor behavior-wise.
[13:14] In terms of control effectiveness, how many times are we overriding data loss
[13:20] prevention policies? Or what is the meantime to deprovision access to
[13:25] information once somebody leaves the company? How many exceptions do we have?
[13:31] In terms of outcomes, how many confirmed insider incidents do we have?
[13:36] How many near misses? What kind of near misses?
[13:39] What are some of the data loss events that have occurred?
[13:41] Are there repeat policy violations?
[13:44] Those are some of the things that you can monitor that would indicate whether you
[13:47] have a problem. Does that answer your question?
[13:50] It does, and it sparks so much for me.
[13:53] One, I think of it like a house, and I think of the way that you just framed this
[13:59] was you have the policy that governs this whole, the do's and don'ts, right?
[14:05] More like a golf course, like a fairway. You have your fairway and out of bounds.
[14:10] But more importantly, you very succinctly stated, access.
[14:15] The types of access, privileged access, emergency, and then the deprovisioning.
[14:22] That is the door. The door, if you're able to then have kind of like
[14:28] good, to your point, controls, the policy on the door itself to the application, to
[14:33] whatever the data, right? To then whatever tool mechanism you have
[14:39] for your user access governance you're monitoring, should, and your exceptions that
[14:44] you highlighted, should be manageable. It should be expected.
[14:49] You shouldn't have all this. So I simply love it.
[14:52] We have Deloitte as our external auditor, and I feel like you
[14:58] were in the room when the Deloitte partners gave us their feedback of what...
[15:04] They said to us, "Hey, Pejoj, when you're planning a 12, 24 months out, six, 12,
[15:10] 24 months out, these are kind of the things to plan for." And you kind of just
[15:15] spelled it out again for us, so thank you.
[15:17] And we can talk about these things generically.
[15:20] I actually read an article recently that talked about some of the things that I
[15:25] just hit on here. It was an InfoSecurity magazine.
[15:29] They published an article, and it hit close to home because I'm from Utah.
[15:33] But InfoSecurity magazine had an article that was published last September 2025.
[15:39] They said that according to breach notifications and subsequent reporting, FinWise
[15:44] Bank, which is a community bank in Utah, and partners with fintech companies,
[15:50] identified a data security incident that involved a former employee who accessed
[15:55] FinWise data after their employment had ended.
[15:58] So the exact scenario that you had talked about.
[16:01] Some of the affected data belongs to American First Finance, which also partners
[16:06] with FinWise to offer installment loan production.
[16:10] With this incident, about 689,000 customers were
[16:16] potentially affected. So the public reports indicate that exposed information
[16:21] included things like names, dates of birth, Social Security numbers, financial
[16:27] information such as account numbers, that kind of thing.
[16:30] And the reason I think where this hit so poignantly for this topic is there's
[16:36] three major issues of note that we've talked about in the alleged unauthorized
[16:40] access. One, it was conducted by a former employee.
[16:44] So that's exactly an insider threat scenario, right?
[16:48] It apparently occurred after termination.
[16:51] So that raises questions about off-boarding process and how to cancel access
[16:57] controls. And then the third, they learned that it went
[17:02] undetected for more than a year. So that highlights the potential monitoring and
[17:08] data loss detection weaknesses that existed there.
[17:11] So not only did they have to disclose to the 689,000 affected people, but
[17:17] after the public disclosure, then FinWise and American First Finance were named in
[17:22] multiple class action lawsuits. Plaintiffs alleged, among other claims, that
[17:26] customer information was not adequately protected and the organization failed to
[17:31] safeguard sensitive data. This is a real issue with real potential loss that
[17:36] could occur.
[17:38] Just think about that, right? One year.
[17:41] And today, we all know of different tools that can do spot, a
[17:47] point-in-time monitoring. You can build.
[17:49] I personally have built my own, and it's janky, it gets the job done.
[17:55] It's not that fantastic. But you're exactly right. There's two pieces.
[17:58] Just the monitoring of the intra-quarter, and then the last piece is
[18:04] when the employee leaves. Yeah, sure, you take the badge and all that stuff, and
[18:08] then checking the box, just checking the box and saying, "All the systems." There's
[18:13] no close the loop of validation to say, "Yes, all the systems for this person,
[18:18] access has been revoked." Does it really require the OCC and the Federal Reserve
[18:24] to come in and say, "Hey, guys, really?" And then you have fines, to your point,
[18:29] and then you have other things, and then they're in the news, right?
[18:33] And then public sentiment.
[18:34] And then the lawsuits that come.
[18:36] Yes.
[18:37] Yes.
[18:37] Exactly. From something that is so... It's not something that's new.
[18:42] I'm just floored. I can't believe that companies still trip on themselves
[18:46] constantly over this. So thank you.
[18:49] Yeah, and that's why when I talked about that interdisciplinary approach where you
[18:54] involve more than just people monitoring data, you'll have to layer on top of HR
[19:00] the other areas, compliance, that would need Need to have awareness of
[19:06] situations that could cause increased risk for this type of thing.
[19:11] You hit on the malicious insider where, and this is a common one,
[19:16] somebody's departing the company that they work for.
[19:19] And this is one of the most common insider threat scenarios, where you have
[19:24] somebody that's preparing to join a competitor.
[19:27] So imagine that the employee gives their notice and they submit their resignation.
[19:33] So let's say they gave their two weeks notice, and they were allowed to continue
[19:37] working on their device with access to information.
[19:41] So they begin downloading customer lists, they look at pricing information, they
[19:47] pull strategic plans, they do some proprietary research.
[19:51] So in organizations that usually detect this threat, it's that
[19:57] coordinated effort that will be most effective.
[20:01] You have HR, who notifies the insider risk team about the resignation.
[20:05] You've got system monitoring, who identifies unusual downloads, and those two data
[20:11] points intersect and are reviewed together so that the company can intervene
[20:17] before the information actually leaves the environment.
[20:20] And organizations that miss it, it's because some of these things might exist,
[20:26] but they're siloed. And HR might know an employee is leaving, security
[20:32] might see unusual activity, but neither side realizes there's a connection until
[20:37] it's too late. That's why that interdisciplinary approach is so important.
[20:42] I think that example just made me think of what we talked about previously, what
[20:48] you highlighted, which was the behavioral or technical, right?
[20:53] And from what you just said, if you're a company and that exactly
[20:58] happened, would you say the indicator, like the red flag would be the behavioral of
[21:04] the person, or would it be the after the fact of, "Oh, the person did this, and
[21:09] therefore it's the technical"?
[21:11] Yeah. So you have the preventive, where you actually
[21:17] know the employee has given notice.
[21:19] So your preventive activity would be, and you can still be transparent to say,
[21:25] "We appreciate the time that you've given to the company.
[21:29] We realize that there's going to be some off-boarding.
[21:31] Please be reminded that at this time we'll be monitoring your activity a little bit
[21:35] more closely to make sure that no proprietary information is leaving the company."
[21:39] So you can be transparent, right? So I would say that that is your point where
[21:43] you're preventing. You're preventing the action.
[21:47] Then you've got the detective, where you start to see the downloading patterns.
[21:52] Now, ideally, if you see the downloading patterns, you've
[21:58] got work group, somebody that looks for these things, that you have people who work
[22:03] together who coordinate with each other.
[22:05] "I'm seeing this on this employee." Like, you've got controls in place that
[22:09] actually notify the people monitoring the data to detect that something is
[22:15] happening, so that they know who they're monitoring and what they're monitoring for
[22:19] to circle back with HR. Now, again, it could be very innocent.
[22:24] So you just do what you normally do. You have an interview.
[22:27] Don't even have to call it an interview to make it sound official and scary, but
[22:31] you have a conversation to say, "Hey, this is what we noted." Don't say, "Is there
[22:35] an explanation for this?" That sounds like you're interrogating.
[22:38] But, "Hey, we've noticed
[22:41] this activity. Can you describe what it is that is going on here?
[22:45] Can you give me a little bit more information about that?"
[22:48] So how do you think organizations actually balance this monitoring
[22:54] and surveillance of employees, and still being able to
[22:59] maintain trust and the employee's privacy while they're trying
[23:05] to monitor insider threats and kind of make certain that there's, not no blind
[23:11] spots, but most of the blinds, right? Okay. You got it.
[23:14] Absolutely. I would say most mature organizations have five things.
[23:19] First, they have clear governance with defined ownership.
[23:23] Second, as previously discussed, they have a multidisciplinary insider risk team
[23:29] that might involve HR, compliance, legal, security, risk management.
[23:35] And then they have the capability to monitor for unusual behavior.
[23:41] And fourth, they have strong identity and access management practices where people
[23:47] only have access to the amount of information that they need in order to do their
[23:52] job and not more. And then they have formal processes
[23:58] around onboarding employees, transferring employees from one department to another
[24:04] because their information needs might change, and then certainly departures.
[24:10] What I think is often missed is this coordination.
[24:13] That you have all the individual controls, but they don't have the mechanism to
[24:18] bring the information together to identify the emerging risk.
[24:22] So that's why I think that in a perfect world, you would have a multidisciplinary
[24:27] team that comes together, whether it be regularly or they know their partners
[24:33] that are part of this multidisciplinary insider risk team that has a way to
[24:38] communicate on the fly, ongoing, real time, that kind of thing.
[24:43] So kind of just following up on that, this interdisciplinary concept of a
[24:49] team. I totally agree. But if we want to have a quick win for a
[24:55] company, and I agree, yeah, creating a group and everyone's time is valuable.
[25:00] Everyone's schedule is packed. Do you think it's possible to add to a,
[25:07] maybe if there's a risk committee-
[25:09] Yeah
[25:09] ... maybe for, right, and adding this topic to making certain it's a standing
[25:15] topic, insider threats to your point, whatever, if it's data loss, data breaches,
[25:21] privileged roles, emergency roles, whatever the key indicators that we've talked
[25:26] about, you've highlighted or mentioned, maybe that could be something?
[25:31] Absolutely. I think that a more real-time working group situation is more
[25:36] effective than a committee. However, your organization complexity, structure,
[25:43] size, information that one has access to, it might not make sense to have that kind
[25:49] of structure where you can come together quickly.
[25:52] And then a committee certainly would work.
[25:55] It depends on how often that committee comes together in order to talk about
[25:59] things. But even just having this on the front of people's minds to talk about and
[26:04] to learn from and to monitor and discuss solutions and preventions
[26:10] goes miles to start towards that path to maturity.
[26:14] When you think about the insider threat life cycle, that includes
[26:20] that element of learning, which I absolutely think that some element of
[26:26] coming together and talking about the risks, maybe events that have happened, the
[26:30] way the company has responded, can talk about it in a committee scenario where you
[26:36] discuss learning and how we can improve our process going forward.
[26:41] Have you ever dealt with an insider threat successfully?
[26:47] Were able to, not prevent it, but you had a process in place that you were able to
[26:52] detect it?
[26:53] I would say I've seen elements of this occur successfully.
[26:58] I'm going to share with you the most common public case that is available and
[27:02] actually has to do with Tesla. It's an oldie but goodie. It happened back in 2018.
[27:08] A Tesla employee reportedly became disgruntled after they didn't receive a
[27:13] promotion, and they used their unauthorized access to make
[27:18] unauthorized changes to manufacturing system code and export company data.
[27:25] So what makes this case interesting isn't that the employee attempted the activity,
[27:30] because we talked about that can happen.
[27:32] It's that Tesla detected it relatively quickly through their monitoring
[27:37] investigation, and then according to Elon Musk at the time, the company
[27:43] identified the individual, investigated the activity, and contained the threat
[27:47] before it could become a much larger event.
[27:50] So the lesson for auditors is that trusted access doesn't eliminate the risk.
[27:56] What mattered is that Tesla had visibility into the user's activity.
[28:01] They investigated those anomalies.
[28:04] They responded quickly once the warning signs appeared.
[28:07] So the Tesla case reminds us that insider threat programs aren't about distrusting
[28:13] employees. They're about recognizing that even highly trusted employees can have
[28:18] moments where personal circumstances, grievances, opportunities create risk.
[28:24] So that comes back to the fraud triangle.
[28:26] Organizations that perform best are the ones that can detect the unusual behavior
[28:32] early and intervene quickly.
[28:34] I like how you brought in the fraud triangle. That's important.
[28:38] And I do recall that Tesla headline from back in 2018.
[28:43] I forgot that it was a disgruntled and didn't get the promotion, but you're exactly
[28:47] right. It can happen to, little things can spark of someone who is otherwise,
[28:52] right, and do things that you wouldn't have expected.
[28:55] Exactly.
[28:56] You're right. You're spot on.
[28:58] So when you think about it, let's go full circle with the threat life cycle.
[29:03] You have conditions that might increase risk.
[29:07] So in this case, it was a disgruntled employee.
[29:10] In another case that we talked about, it was somebody departing the company.
[29:15] That leads to a behavior, which then leads to an event that happens, which then
[29:21] could potentially lead to an impact.
[29:23] Is it an impact that is negative? Did it occur, or was it a
[29:29] near miss? That then leads to how is the company going to respond?
[29:34] Do they have an open risk in the system that needs to be addressed?
[29:38] Do they need to put in another control, something else that they're monitoring?
[29:43] And then additional learning. What can we learn from this?
[29:47] How do we need to change our processes?
[29:49] I think when you mentioned impact for public companies, you have
[29:55] reputational risk, and then the public market.
[29:59] For any company, you have your customer risk, supplier
[30:05] risk. So, yeah, it becomes real in a hurry.
[30:08] Is there anything else that you may want to just highlight here?
[30:12] I would say that the most common assumption that people make when it comes to
[30:18] insiders is that we trust our people.
[30:20] That's right.
[30:21] So because people trust people and they know that they're hiring trusted people,
[30:27] they could not have the right types of monitoring that should exist for the
[30:33] types of information that they have and that they're stewards of.
[30:38] So I would say most threats originate from ordinary
[30:43] people operating under normal conditions, and they could have
[30:49] compromised credentials. They fall for the phishing.
[30:53] They give information that they shouldn't have given.
[30:58] I think that in terms of falling for a phishing attack or
[31:04] falling for somebody that is trying to get credentials, especially with the
[31:10] use of AI and some of the sophistication that comes with that, an employee could
[31:16] give information or give their credentials and immediately think, "Oh, I
[31:22] just did what I've been trained not to do." The question is, have you given
[31:28] employees permission to be able to elevate that situation
[31:34] and be able to self-report to say, "This just happened.
[31:39] I think I made a mistake," without a consequence?
[31:43] Can the employee self-report and not be given a negative consequence?
[31:48] Instead, it's, "Thank you so much for acknowledging that happened and coming
[31:54] so quickly to self-report." What can a company do?
[31:59] Where could an organization start?
[32:01] I would say your first starting point is identify who owns the
[32:07] insider risk so that they can apply what type of approach and who should
[32:13] have a seat at the table when you're looking at these sorts of things.
[32:17] Then assess where the highest risk exists for that
[32:22] organization. What's the highest data risk? What's the highest systems?
[32:28] What are the processes with the highest risk for insider threat?
[32:32] And then evaluate your access management practices to any of those
[32:37] processes, whether it be data systems or processes, right?
[32:42] Especially around the privileged user and departing employees.
[32:47] Those are the two biggest risks. If you're going to start somewhere, start with
[32:52] privileged users and departing employees.
[32:55] And then the fourth is where you can create that multidisciplinary team who can
[33:00] share information across silos, HR, security, compliance.
[33:07] If I had to leave auditors with one thought, it's this: Insider threat management
[33:12] is ultimately about connecting those dots.
[33:15] Most organizations have controls that operate maybe in silos.
[33:21] The challenge is to bring together the people, processes, and information early
[33:25] enough to recognize the risk before it becomes an incident.
[33:30] Well, Yvette, I really have enjoyed this conversation about insider threat
[33:33] management. I personally have learned a lot. Thank you so much.
[33:37] It's been a pleasure talking to you today. Thank you so much.
[33:41] If you like this podcast, please subscribe and rate us.
[33:44] You can subscribe wherever you get your podcasts.
[33:47] You can also catch other episodes on YouTube or at theiia.org.
[33:51] That's T-H-E-I-I-A.O-R-G.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.