The Many Faces of Insider Threats

Why One Detection Model Is Not Enough

Many organizations approach insider threats primarily through a cybersecurity lens, with programs designed to prevent and detect familiar scenarios such as a departing employee copying files to personal storage. In practice, insider threats can involve misuse of legitimate access, fraud, misconduct, physical harm, or cyber activity, and the motivations and methods behind that activity can vary dramatically. A traditional one-size-fits-all prevention and detection model may therefore overlook emerging categories of insider risk.

An insider may use corporate systems to target third parties, use AI assistants while moving restricted data and developing concealment techniques, or cause physical harm while communicating through personal, off-network channels. These scenarios all fall within the insider threat category, but create different signals, evidence sources, and response requirements. As threats continue to evolve, insider risk programs may appear effective while remaining largely blind to activity that falls outside the profile they were designed to detect. Organizations need to reconsider which insider behaviors they monitor, where evidence of those behaviors is likely to emerge, and if the proper detection mechanisms are in place to recognize threats.

Emerging Insider Profiles

Cybersecurity investigations conducted by FTI Consulting have revealed three scenarios that illustrate how widely insider threats can vary from the traditional insider profile.

The Employer as the Attack Source
A technically capable employee may use corporate workstations, infrastructure, or intellectual property (“IP”) space to conduct offensive activity against external organizations, turning the employer into the attack source. This type of activity can create potential third-party notification, law enforcement, and insurance implications while leaving a dense forensic footprint including command-line history, screenshots, tracking files, network artifacts, and campaign dashboards.

This activity may be difficult to identify if relevant material is removed from a live device before the threat is identified. Forensic snapshots, endpoint backups and retained historical security telemetry may provide evidence of earlier activity, including prior file states, system events or command execution. However, the ability to recover this information depends on what the organization captured, how long it was retained and whether preservation occurred before the relevant data was overwritten or deleted. In this scenario, an insider risk creates significant exposure even when corporate data is not the target. Monitoring models focused primarily on data leaving the organization may therefore leave a gap in detection.

Leveraging AI to Hide Activity
AI can provide technical capability on demand to an individual who is not a security practitioner. A motivated employee may use AI assistants to research what an employer can observe, develop scripts, explore anonymization options, or support actions intended to conceal activity. Indicators of this type of activity can be discovered within restricted-share access, endpoint telemetry, personal code repositories, virtual private network traffic, anti-forensic activity, and the installation of encryption tools. Viewed separately, these actions may seem harmless, but considered together and in sequence, they can reveal a pattern of collection and concealment.

When available, artifacts associated with AI interactions can become an important evidence source. Depending on the platform and its configuration, relevant information may appear in browser storage, endpoint artifacts, enterprise audit logs or histories retained by the service provider. The availability and completeness of these records can vary considerably, however, and traditional monitoring may not routinely capture them. When preserved, this material can help investigators understand the capabilities an individual sought and the sequence in which activity developed.

Physical Instead of Digital Evidence
Some insider threats leave little or no traditional digital evidence (ex. malicious execution, data loss prevention alerts, endpoint detections). Instead, an employee may communicate through a personal device and encrypted, off-network channel while the harm itself is physical rather than digital. If relevant signals such as repeated equipment damage, facilities reporting, and physical security records are consistently treated as accidental, a potentially important pattern may never reach the security team.

This is a critical blind spot for insider programs focused only on security operations monitoring. Facilities may see recurring equipment damage, while security teams see no anomalous system activity, and the human resources team (“HR”) holds separate contextual information. Without a mechanism for escalation and coordinated review, each signal may remain inconclusive on its own.

Motive Determines Where the Evidence Appears

Different motives produce different behaviors, and those behaviors determine where evidence appears. One of the scenarios described above may leave extensive host and network artifacts; another may concentrate evidence in browser storage and endpoint telemetry; and the third may leave almost nothing in corporate systems, with relevant information appearing instead in damage reporting and open sources.

Organizations should therefore avoid relying on a single archetype or tooling stack. Detection and investigation models should connect technical telemetry with relevant information from HR, facilities, physical security, legal, and threat intelligence teams. It is also imperative to account for emerging evidence sources including browser-side AI data, third-party archives, and public platforms.

Detection and investigation require different forms of coverage. The system or organizational function that first raises a concern may not hold the evidence needed to determine what occurred, why it occurred or how the activity developed. An initial signal might emerge from network monitoring, facilities reporting or a public source, while the evidence needed to establish intent and sequence resides in endpoint telemetry, browser artifacts, enterprise records or information maintained by another function. Insider risk programs should therefore plan separately for how concerns are detected and how evidence will be identified, preserved and connected during an investigation.

Building a More Adaptable Insider Risk Program

Technical evidence may be only one component of a thorough insider threat investigation. To account for a growing range of motives and tactics from malicious insiders, organizations should focus their insider risk programs on five priorities:

Design around varied behaviors and motivations. A program monitoring only for data theft near an employee’s departure may not detect attacks against third parties, AI-enabled concealment, or physical sabotage.
Connect detection signals with investigative evidence. The function that identifies an initial concern may see only one part of the broader pattern. Organizations need defined mechanisms for bringing together relevant information from HR, facilities, physical security, legal, and threat intelligence when an investigation is warranted.
Preserve evidence early. Forensic snapshots, retained endpoint and security telemetry, browser profiles, and public-source material may contain information that disappears from live systems or online platforms, and can only be recovered when collected, retained, and preserved.
Prepare for evidence outside traditional monitoring. Client-side browser storage, third-party event archives, and open sources may provide information that the organization’s own logging does not capture. Non-technical evidence can also be critical for a thorough investigation, including details about a potential insider when available, such as significant life events, unexplained new wealth or debts, or abnormal hours in the office.
Account for legal, privacy and employee monitoring requirements. Cross-functional investigations and the collection of information from nontraditional sources should be conducted in coordination with legal, privacy and HR stakeholders and in accordance with applicable laws, organizational policies and employee monitoring requirements.

The threat landscape is constantly evolving, including the tactics and techniques of inside actors. Programs need to recognize that different insiders leave different trails across many organizational departments. The ability to identify, preserve, and connect those signals before seemingly unrelated activity develops into a larger crisis is critical.

The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.

Related Insights

Published

November 05, 2026

Key Contacts

Philippe Baumgart

Senior Managing Director