The alert
What arrived
A record that a rule matched, produced by a system with no knowledge of context. Everything beyond that is inference.
What an Alert Is and Is Not
A signal that a rule matched, produced by a system with no knowledge of context. Treating it as an accusation is the first and most consequential error.
Where Insider Signals Come From
Five sources, with different reliability and very different implications for how an alert should be handled.
The Base Rate Problem
Deliberate insider wrongdoing is rare. Any detection applied across a whole workforce therefore produces far more innocent matches than guilty ones, however good it is.
Reading a Risk Score Without Believing It
A number attached to a person, composed of weights nobody in the organisation chose. What it can support and what it cannot.
The Alert That Is Actually a Process Failure
A large share of what looks like insider activity is somebody working around something broken. Recognising the pattern changes the response and fixes the cause.
Volume, Fatigue and What Gets Missed
A queue nobody can clear produces two failures at once: real signals ignored and innocent people handled carelessly.
Logging the Alert Before Anybody Looks
The record created in the first minute determines whether the case can be assessed afterwards. Four fields, before any judgement is formed.