Insider risk management (IRM) platforms watch what trusted people do with legitimate access, which makes them both powerful and easy to get wrong legally and culturally. Products in this market grew out of data loss prevention, user and entity behaviour analytics (UEBA), employee monitoring and productivity suites, and they differ widely in which signals they collect, how they score risk, how they protect the privacy of the people they watch and how cases move to HR and legal. This vendor-neutral buyer's guide sets out the requirements to agree first, the capabilities to compare, questions to put to vendors and a proof of concept plan. It is for security, HR, legal and privacy stakeholders choosing a platform together. Programme design is covered in the Insider Threat Programme Guide; this page is about the tool.
Key takeaways
- Buy for the programme you have. CISA frames insider threat mitigation as define, detect and identify, assess and manage; a platform only helps with the middle steps if the first and last already exist.
- Signals beat volume. The value is in correlating HR events, access changes, data movement and behaviour, not in collecting keystrokes and screenshots.
- Privacy controls are core features. Pseudonymised review, role-separated de-anonymisation and complete audit logs determine whether you can lawfully deploy the tool in the UK, the EU and anywhere with works councils.
- AI tool usage is now a primary signal. Pasting sensitive data into public generative AI tools is a common unintentional insider risk, so check how each product sees it.
- Case workflow decides outcomes. Evidence handling, HR and legal hand-off and escalation paths matter as much as detection quality.
Define requirements
- Scope of insiders: CISA defines an insider as anyone who has or had authorised access to, or knowledge of, an organisation's resources, including contractors and vendors. Decide whether third parties, leavers in their notice period and privileged administrators are in scope. See the Insider Threat and Identity Guide.
- Threat types: CISA distinguishes unintentional (negligent or accidental), intentional, collusive and third-party insiders. Rank which matter most; data theft by departing staff and accidental exposure need different signals from sabotage. See the Insider Data Theft Guide.
- Legal basis and jurisdictions: List every country where monitored staff work. ICO guidance on monitoring workers says a data protection impact assessment (DPIA) is required for high-risk monitoring such as keystroke monitoring or biometrics, that consent is rarely an appropriate lawful basis in employment, and that covert monitoring is only for exceptional cases. The guidance is under review following the Data (Use and Access) Act, so check its current status. Works councils in several EU countries may need to agree monitoring before it starts. See the Employee Monitoring and Privacy Guide.
- Owners: Agree who triages (security), who investigates (an insider risk team), who decides (HR, legal) and who audits the auditors (privacy or internal audit).
- Existing stack: Inventory what DLP, endpoint, CASB, identity and SIEM tools already collect, so the platform adds correlation rather than duplicate agents. See the Data Loss Prevention (DLP) Guide.
Capability areas
| Area | What to look for |
|---|---|
| Signal sources | Connectors for HR systems (resignation, notice, performance plan), identity provider and PAM, endpoint, email, cloud storage, SaaS audit logs, DLP and physical access; documented field mappings |
| Behaviour analytics | Per-person and peer-group baselines, sequence detection (for example resignation followed by mass download), explainable risk scores showing which indicators contributed |
| Data movement | Visibility of uploads to personal cloud storage (ATT&CK T1567.002), USB copying (T1052.001) and auto-forwarding rules to external mail (T1114.003), with content classification from your DLP labels |
| AI tool usage | Detection of sensitive content pasted or uploaded to generative AI services, sanctioned versus unsanctioned tool distinction, prompt capture policy that respects minimisation |
| Privacy by design | Pseudonymised alerts by default, de-anonymisation only by a separate role with recorded justification, configurable retention, per-country policy scoping, excluded categories (union, occupational health) |
| Case management | Case timeline, evidence export with integrity hashes, notes, HR and legal hand-off, legal hold, outcome codes that feed tuning |
| Response | User notification templates and just-in-time coaching, adaptive DLP enforcement for high-risk users, access revocation through identity integrations, SIEM and SOAR export |
| Non-human identities | Attribution of activity through service accounts, API keys and tokens back to a human owner, and alerts when a leaver's credentials remain active |
Evaluation criteria (table)
| Criterion | Weak | Strong | Weight guide |
|---|---|---|---|
| Signal correlation | Single-source alerts relabelled as risk | Sequences across HR, identity and data events with explained scores | High |
| Privacy controls | Names visible to all analysts; no audit of reviewers | Pseudonymised by default, dual-role reveal, full reviewer audit log, data subject access export | High (mandatory in UK and EU) |
| Explainability | Opaque score | Each indicator shown with evidence so a worker can see and challenge the result, as ICO guidance expects | High |
| Deployment footprint | New heavy endpoint agent for every signal | Reuses existing DLP and endpoint telemetry; agent optional | Medium |
| Case workflow | Alerts only, evidence in screenshots | Structured cases, hashed evidence export, HR and legal roles | High |
| Tuning | Vendor-only changes | Customer-editable indicators, thresholds and exclusions with version history | Medium |
| Data residency and retention | Fixed region and retention | Choice of region, retention per data type, deletion on request | Medium to high |
Small versus large organisations: a small firm with one productivity suite may get enough from the suite's built-in insider risk features plus DLP. A large or multinational organisation usually needs independent connectors, per-country policy scoping and formal case management that can stand up in employment tribunals.
Questions to ask vendors
- Which signals are collected by default, and can each one be switched off per country or business unit?
- Show an alert as a first-line analyst sees it. Who can reveal the person's identity, and where is that action logged?
- How is a risk score built? Show the indicators and evidence behind one.
- How do you detect sensitive data going to generative AI tools, and do you store prompt content?
- How do you handle special category data captured incidentally, such as messages to occupational health?
- How would we answer a subject access request from a monitored employee?
- What material do you provide for our DPIA and works council consultation?
- How do you link activity by service accounts and API keys to a responsible person?
- What is the false positive rate in comparable customers, and how is tuning done?
Red flags
- Keystroke logging, continuous screenshots or webcam capture promoted as standard features rather than tightly controlled exceptions.
- No pseudonymisation, or reveal controlled by the same role that triages.
- Risk scores with no visible reasoning.
- Marketing that frames employees as suspects, which undermines trust and works council approval.
- No answer on data subject rights, retention or residency.
- Alerts that cannot be exported with evidence integrity for HR or legal processes.
Proof of concept
- Complete a draft DPIA and brief the works council or staff representatives before any data flows.
- Connect HR, identity, DLP and one cloud storage source for a limited, consenting pilot group or test accounts.
- Run scripted scenarios: a leaver bulk-downloading files in their notice period (the kind of gap seen in the Coupang breach, where a former engineer's key stayed valid), uploads to personal cloud storage, an auto-forward rule, and pasting labelled source code into a public AI chatbot as in the Samsung ChatGPT leak.
- Measure detection of each scenario, time to alert, alert precision, and how clearly the score is explained.
- Walk one alert through the full case workflow: pseudonymised triage, justified reveal, investigation, HR hand-off, evidence export and closure.
- Test a subject access request and a deletion request end to end.
- Have HR, legal and privacy sign off alongside the SOC before scoring.
Controls to map the deployment to include NIST SP 800-53 PM-12 Insider Threat Program, AT-2(2) Insider Threat awareness training and AU-6 audit record review. CERT's Common Sense Guide to Mitigating Insider Threats (seventh edition, 22 best practices drawn from more than 3,000 cases) and the NITTF Insider Threat Program Maturity Framework help define what the programme around the tool should look like. See also the Insider Risk from AI Tools Guide and the DLP Buyer's Guide.
How NHI Mgmt Group can help
We provide independent requirements and evaluation support. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Insider Threat Programme Guide · Insider Threat and Identity Guide · DLP Buyer's Guide · Employee Monitoring and Privacy Guide