The risk
Not all harm comes from the attacker who breaks in. It can come from a person already inside, with a badge, a laptop, and every right to be there.
Legitimate access can expose information, disrupt operations, divert funds, or harm people. The cause may be deliberate conduct, an error, or an automated action outside its intended scope. Assessing that risk requires evidence of what happened, what was authorized, and the business context, and that evidence is often spread across systems and teams.
Managing it requires Security, Legal, Human Resources, privacy specialists, and the business to work within the applicable privacy and employment requirements.
The solution
I design and implement insider risk management programs and information protection controls for organizations operating in Europe.
The work addresses applicable privacy, employment, and cybersecurity requirements, including GDPR, NIS2, and DORA where relevant. I can build a program from the start or work on a defined part of an existing function. The six services cover governance, information protection, detection, investigation and response, operations, and assessment.
FAQ
What is an insider risk management program?
An insider risk management program defines how an organization prevents, detects, investigates, and responds to harm arising from legitimate access. It assigns responsibilities, sets the permitted scope of monitoring, and establishes the controls, procedures, and measures used to assess its effectiveness. In this practice, insider risk is the possibility of harm arising from the use of legitimate access, through deliberate or unintentional action or omission. The program is built on the organization’s own scenarios: who, with which access, could cause harm to which asset, and through which channel. Detection is designed for them, and coverage and gaps are measured against them.
The organization already owns Microsoft Purview. What is missing?
The platform provides capabilities; the organization still needs to define how to use them. Microsoft Purview Insider Risk Management, Data Loss Prevention, and Information Protection include signals, policy templates, and default thresholds. What the organization adds: the relevant risk scenarios, approved monitoring purposes, configured policies, tested thresholds, and procedures for reviewing alerts and taking action. I translate those requirements into the supported capabilities of the products and licenses in place, then test and tune the configuration against the organization’s data.
Can the Security Operations Center (SOC) handle insider cases?
Yes, if the mandate, skills, and procedures cover insider cases. Technical records may establish what an account did, but may not establish whether the action was authorized for that purpose or justified by the business context. The operating model must define how the SOC obtains that context, involves the relevant functions, and escalates decisions.
The record
Reference resources and technical analysis.
Insider Threat and Risk Architecture (INTRA) brings together jurisdiction-specific requirements for the measures used in an insider risk management program. Insider Threat Event Requirements (ITER) records reporting obligations that may arise from insider events, including their conditions and deadlines. Insider Risk Atlas classifies insider risk scenarios by access population, act, and primary asset, with references to the Insider Threat Matrix™. The three are open, free to use and to cite with attribution. The articles, diagrams, and notes examine program design, information protection, detection, investigation, and operations.
- open artifacts
- 3
- jurisdictions
- 34
- sources reviewed
- 223
- articles
- 9
- diagrams and notes
- 5
INTRAITERAtlasArticlesDiagrams and notes
LatestModels as Insiders: Whose Authority, and Whose Data | 12 October 2026
Contact
If you are building an insider risk function or improving how your organization protects sensitive information, write to me.
A few lines are enough: your current setup, the problem to address, and the outcome you need. We can then define the scope and next steps. I treat initial enquiries as confidential.