All Posts

AI agents are moving rapidly from experimental assistants to operational actors inside the enterprise. They can retrieve data, call tools, invoke APIs, coordinate workflows, retain memory, and act under delegated authority. For insider risk professionals, that shift changes the risk equation.

As we gather with family and friends this Independence Day, many organizations will also find themselves operating with reduced staffing, extended weekends, and a false sense of security. While we celebrate freedom, those intent on exploiting organizations are often looking for the very opportunities that long weekends create.

The pace of change in today's threat landscape is unprecedented. New technologies, shifting geopolitical dynamics, and increasingly sophisticated adversaries are transforming how organizations must think about security. While technical defenses remain essential, they are no longer sufficient on their own. The future of insider risk management depends on a deeper understanding of people—their behaviors, motivations, context, and intent.

Ask any insider risk professional what keeps them up at night, and the answer is rarely “lack of alerts.” It is the fear of being wrong—of targeting the wrong employee, missing the real threat, or making a decision that cannot be defended after the fact. Bias sits at the center of that risk. It influences how analysts interpret data, how leaders shape priorities, and how technology translates assumptions into automated judgments.

Insider threats occur when someone uses legitimate access (intentionally or accidentally) to harm the organization. Insider threats arise from a mix of personal vulnerabilities and organizational conditions. It’s not just who someone is—it’s what they experience and how the organization responds.

Understanding insider threats has long been compared to “connecting the dots,” but this analogy dramatically understates the complexity of the real analytic challenge. In work conducted between 2005 and 2010, I introduced the “shredded puzzle graphic” as a way to more accurately depict the process of insider threat assessment—a multilayered, inference driven workflow that transforms raw, heterogeneous data into meaningful behavioral interpretations.