Top 10 Insider Threat Indicators: Warning Signs to Watch and How to Respond

Insider incidents are rarely sudden: the person usually plans, tests access and moves data before the damage is done, and the signs are spread across security logs, HR records and what colleagues notice. This page ranks the ten indicators that most reliably precede insider data theft, fraud and sabotage, with a real incident for each where one is documented, how to detect it, what a false positive looks like and what to do. It covers malicious, negligent and compromised insiders, and the newer case of remote workers hired under false identities. It is written for insider risk analysts, SOC teams, HR partners and the managers who are often first to notice a change. How to build the programme that receives these signals (governance, legal review, case handling) is in the Insider Threat Programme Guide; this page is the short list of what to look for.

The Top 10 at a glance

The ranking reflects how often each indicator appears before documented insider cases and how actionable it is, as an editorial judgement drawn from CISA's insider threat guidance, the Carnegie Mellon SEI CERT Common Sense Guide to Mitigating Insider Threats and the incidents in the NHI Mgmt Group breach database. No single indicator proves intent. CISA notes that most people under stress never cause harm, and that malicious acts are usually planned rather than spontaneous, which is why the planning stage (indicators 1 to 6) is visible in logs.

1. Unusual volume of data downloaded, copied or uploaded

What it looks like: bulk downloads from SharePoint, Confluence, CRM or code repositories (T1213 Data from Information Repositories), archives created on the endpoint (T1560 Archive Collected Data), uploads to personal cloud storage or webmail (T1567.002 Exfiltration to Cloud Storage), copies to USB drives (T1052.001), and pasting of source code or customer data into public AI tools. The Samsung ChatGPT source code leak is the negligent version: employees entered proprietary source code and a meeting transcript into a public chatbot, and the company temporarily restricted generative AI tools on its devices.

False positives: migrations, audits, legal holds and project handovers produce the same volumes. Compare against the person's own baseline and their peer group, not a fixed threshold.

What to do: route high-severity DLP events for sensitive labels to the insider risk team with context (role, HR status, destination), and block uploads to unsanctioned personal storage outright. See the Endpoint DLP Guide and the Insider Risk from AI Tools Guide.

2. Access to data outside role or need to know

What it looks like: a support agent searching customer records with no open ticket, a clinician viewing records of patients not in their care, an engineer browsing repositories for products they do not work on, or a finance user querying salary tables (T1039 Data from Network Shared Drive). In the Coinbase insider breach, bribed support agents used their normal tools to pull data on 69,461 customers, which was then used in impersonation scams.

False positives: cover for absent colleagues, escalations and quality reviews. Check whether a case or ticket explains the access.

What to do: tie support tool access to the active case where the platform allows, mask sensitive fields by default, and alert when record views per user exceed the peer baseline (NIST SP 800-53 AU-6, AC-6).

3. Data movement around resignation or dismissal

What it looks like: a spike in downloads, email forwarding to personal addresses or printing in the weeks before or after someone hands in notice, is told about redundancy or is passed over for promotion. The CERT Common Sense Guide describes reviewing activity for 30 days before and after resignation in intellectual property theft cases and says HR must tell IT about departures so enhanced monitoring can begin.

False positives: people legitimately collect personal files (payslips, photos) and hand over work. Agree in policy what may be taken.

What to do: feed HR events (notice given, performance plan, redundancy consultation) into the insider risk tool as context, run a standard leaver review covering downloads, uploads, forwarding and print, and remind leavers of their obligations in the exit process. The HR event is context, never a trigger for action on its own. See the Insider Data Theft Guide.

4. Access that survives a role change or departure

What it looks like: a former employee's account, VPN profile, API key or signing key still works; a mover keeps the entitlements of their old team. In the Coupang breach, a former engineer's signing key was not revoked and was used to access about 33.7 million accounts. Machine credentials (keys, tokens, service account passwords) that a person created or knew are the most commonly missed.

False positives: few. Any successful use of a leaver's credential is an incident until shown otherwise.

What to do: disable accounts from the HR system of record on the last day (PS-4 Personnel Termination, AC-2), rotate every shared secret and key the person could access, and reconcile directory, SaaS and cloud accounts against HR monthly. See the Employee Offboarding Security Guide and the Joiner-Mover-Leaver Guide.

5. Creating accounts, keys or privileges without a ticket

What it looks like: an administrator creates a local or cloud account (T1136 Create Account), adds themselves to a privileged group, generates a new access key or adds a credential to an application (T1098 Account Manipulation), with no change record. This is the classic preparation for sabotage or for keeping access after leaving.

False positives: emergency fixes made outside process. These should still be ticketed afterwards; the absence of a retrospective ticket is itself a finding.

What to do: alert on privileged group changes, new access keys and new application credentials, match them to change tickets daily, and require just-in-time elevation through PAM so standing privilege is rare. See the Insider Threat and Identity Guide and the Insider Sabotage Response Playbook.

6. Attempts to disable or get round security controls

What it looks like: DLP or EDR agents stopped or uninstalled (T1685 Disable or Modify Tools), proxy bypass through personal hotspots or VPN apps, encrypted archives with passwords to defeat content inspection, renaming files to hide sensitive labels, or repeated requests for exceptions to USB or upload policies.

False positives: broken agents after updates and developers testing tools. Check agent health trends across the fleet before treating one host as suspicious.

What to do: alert on agent tamper and health gaps per user, block unsanctioned VPN and anonymiser categories, inspect or block password-protected archives leaving the network, and require exceptions to expire. See the Data Loss Prevention (DLP) Guide.

7. Activity at unusual times, places or devices

What it looks like: sign-ins late at night or at weekends when the person never worked those hours, access from new countries or personal devices, badge entries to areas outside the person's role, or sessions during leave (T1078 Valid Accounts).

False positives: on-call, travel, time zones and flexible working generate most of these. Use them to raise the priority of indicators 1 to 6, not as alerts by themselves.

What to do: baseline working patterns per user, join identity and physical access logs (PE-3 Physical Access Control), and treat a credential used while the owner is on leave or in another place as possible account compromise. A compromised account looks like an insider in the logs, so rule it out first. See the UEBA Guide.

8. Concerning workplace behaviour and grievances

What it looks like: CISA's insider threat guidance lists behavioural indicators such as conflicts with colleagues or supervisors, unusual interest in matters outside the person's duties, repeated policy violations, statements of resentment or intent to harm, and significant personal stress. Managers and colleagues usually see these long before any system does.

False positives: most people with grievances never act on them. Behavioural reporting must not become a tool for settling personal disputes or for discrimination.

What to do: train managers on what to report and how, give a confidential reporting route, route concerns to a multidisciplinary hub (HR, legal, security), and offer support such as employee assistance before sanctions. CERT recommends positive incentives that encourage good behaviour rather than coercion. See the Insider Threat Programme Guide.

9. Outside approaches, bribery and unexplained affluence or debt

What it looks like: staff contacted on social media or messaging apps with offers for access or data, sudden spending that does not match pay, serious debt or gambling problems disclosed or reported, or undeclared outside business interests. Criminal groups recruit insiders at telecoms firms, banks and crypto platforms for SIM swaps, data and account access, as the Coinbase case showed.

False positives: financial circumstances are private and often explained by inheritance, a partner's income or a side business. Handle through HR and personnel security, not the SOC.

What to do: tell staff that approaches happen and give them a no-blame way to report one, require declaration of conflicts of interest, and apply enhanced screening and periodic re-screening to roles with access to critical assets (PS-3 Personnel Screening). The UK National Protective Security Authority's personnel security guidance covers ongoing aftercare for these roles.

10. Identity mismatches in remote workers

What it looks like: a new remote hire whose face on video does not match their documents, who refuses camera use, whose laptop connects from a different country than stated, or whose device runs remote access tools that let someone else operate it (T1219 Remote Access Tools). The US Justice Department announced coordinated actions in June 2025 against North Korean remote IT worker schemes, including searches of laptop farms in multiple states and charges covering more than 100 US companies.

False positives: people working while travelling, or using legitimate remote support tools. Confirm with HR before acting.

What to do: verify identity in person or with strong remote proofing at hiring, ship devices only to verified addresses, alert on remote access tools and on the laptop's public IP not matching the declared location, and pay only to accounts in the verified name. See the Insider Threat from Fake IT Workers Guide.

Detection and measurement

Most insider risk tools combine these indicators into a per-user risk score. Use scores to prioritise analyst time and explain what drives each one; never open a formal investigation on a score alone.

In the UK and EU, monitoring workers requires a lawful basis, transparency and a data protection impact assessment for intrusive monitoring; the UK Information Commissioner's Office guidance on monitoring workers sets out these expectations.

Metrics that show the programme is working:

• Leaver deprovisioning time: median hours from HR end date to account, key and token revocation (target same day).
• Orphaned access found: number of active accounts or credentials of leavers found in monthly reconciliation (trend to zero).
• Alert precision: share of insider alerts that analysts confirm as policy violations or incidents.
• Time to triage: median hours from high-severity indicator to analyst decision.
• Manager reporting rate: concerns reported through the official channel per quarter, a sign that people trust it.
• Unticketed privilege changes: privileged changes without a matching change record per month.

Common failure patterns

• Acting on one indicator: treating a resignation or a late-night login as evidence. It damages trust and wastes analyst time; combine signals.
• HR and security never connected: security sees the download spike, HR knows the person resigned last week, and nobody joins the two until after the data has gone.
• Offboarding that stops at the directory: the account is disabled but keys, tokens and shared passwords stay valid, the Coupang pattern.
• Support tools with unlimited search: any agent can query any customer, so one bribed agent harvests thousands of records.
• Monitoring without legal review: intrusive monitoring rolled out without counsel, a DPIA or staff notice, producing evidence that cannot be used and complaints that can.
• Ignoring the compromised insider: assuming every anomaly is malicious intent when it is often an attacker using stolen credentials; check for compromise first.

Mapping to frameworks

Where to start

1. First 30 days: reconcile accounts, keys and tokens against HR and remove leavers' access; turn on alerts for privileged group changes and new access keys.
2. Days 30 to 90: connect an HR feed (notice, leave, end dates) to security tooling with legal sign-off, and set DLP rules for uploads to personal storage and USB for your most sensitive labels.
3. Days 90 to 180: restrict support and operations tools to need-to-know access, train managers on behavioural reporting, and add identity checks for remote hires.
4. Ongoing: review confirmed cases each quarter, retire indicators that only produce false positives and add the ones your incidents show.

Small organisations without an insider risk team should start with indicators 4 and 5 (offboarding and privilege changes), which need no new tools. Large organisations usually have the data; their gap is joining HR, security and manager reports into one case.

Practitioner checklist

• Leavers lose accounts, keys, tokens and shared secrets on their last day, verified by reconciliation.
• Privileged group changes and new credentials are matched to change tickets.
• DLP covers personal cloud uploads, webmail, USB and public AI tools for sensitive data.
• Support tools restrict agents to records in their active case, with volume alerts.
• HR events reach the insider risk team as context, under a documented legal basis.
• Security agent tamper and health gaps are alerted per user.
• Managers know what to report and have a confidential route.
• Remote hires are identity-verified and their devices checked for remote control tools.
• No investigation opens on a single indicator or a risk score alone.

Standards and references

• CISA: Insider Threat Mitigation
• CISA: Insider Threat Mitigation Guide
• Carnegie Mellon SEI: Common Sense Guide to Mitigating Insider Threats, Seventh Edition
• US Department of Justice: Coordinated nationwide actions to combat North Korean remote IT workers
• ICO: Monitoring workers
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• MITRE ATT&CK: Exfiltration to Cloud Storage

Related NHI Mgmt Group resources: Insider Threat Programme Guide · Insider Threat and Identity Guide · Insider Data Theft Response Playbook · Insider Threat Statistics Guide · Insider Risk Management Buyer's Guide