All Posts

Insider threats occur when someone uses legitimate access (intentionally or accidentally) to harm the organization. Insider threats arise from a mix of personal vulnerabilities and organizational conditions. It’s not just who someone is—it’s what they experience and how the organization responds.

Understanding insider threats has long been compared to “connecting the dots,” but this analogy dramatically understates the complexity of the real analytic challenge. In work conducted between 2005 and 2010, I introduced the “shredded puzzle graphic” as a way to more accurately depict the process of insider threat assessment—a multilayered, inference driven workflow that transforms raw, heterogeneous data into meaningful behavioral interpretations.