What is insider risk? An insider has, or has had, legitimate access and misuses it. Single indicators are noise, sequences such as download, downgrade and exfiltrate tell a story. Signals from identity, devices, data and apps flow through the unified audit log into Insider Risk Management, which scores activity and raises alerts based on policy templates. An employee downloads files, lowers a label and tries to email them to a private address. DLP stops the email and the insider risk rises. W INSIDER RISK MANAGEMENT What is insider risk? Ada Admin Eli Employee Ronny Insider WHO IS THE INSIDER? Someone who already has the keys A current or former employee, consultant or contractor with legitimate access to systems and information, who misuses that access to cause harm or loss. It's a trust problem, not a break-in problem. Firewalls and sign-in controls don't help. The access is valid. And today, the insider can also be an AI agent. TYPICAL TECHNICAL INDICATORS What insider risk looks like in the logs SEQUENCES One action is noise. A sequence is a story. Insider Risk Management looks for these sequences, and scores them higher than each step alone. HOW THE SIGNALS FLOW POLICY TEMPLATES Start with the risk you want to find MICROSOFT 365 TENANT OUTSIDE THE ORGANIZATION SharePoint Customer files DLP Private email ronny@freemail.example Insider Risk Management Waiting for a trigger Alert: High Customer list Confidential IN PRACTICE Ronny has handed in his notice He has two weeks left, and access to the customer files. Good to know 1/7 INSIDER RISK MANAGEMENT What is insider risk? Most data leaks start with someone who already has access. We look at what insider risk is, which signals give it away, and how Insider Risk Management connects them before the data is gone. informasjonsbeskyttelse.no