ArticlesInsider Threat Detection Is Not Built to Catch, but to Understand

Yet another piece opening on Shadow AI. The example is everywhere by now, worn smooth from use, and that is precisely why it is worth taking: a case this familiar has usually stopped being examined. Everyone points at it, few read it closely. So, one more time, with attention.

An employee has a report due by end of day. The internal tools are slow, or blind to the task, so they paste a few paragraphs into a public AI assistant, get what they need, and move on. The data is now outside the perimeter, on a server the company does not control, and it will not come back. On the detection side, this looks almost exactly like exfiltration: sensitive content leaving through an unsanctioned channel.

Almost. And the entire weight of the case sits in that word.

Call that event theft, and you have not just misread a log. You have put a shadow over a person who was trying to finish their work, and over the quality of everything they do next. No one is arrested, nothing is proven, but a name now carries a question it did not earn. Around that person, a multidisciplinary machine starts to move, legal, HR, compliance, each on the assumption that the classification upstream was sound. And when it was not, the cost does not land only on the individual. It lands on the function that made the call. A team that mistakes intent often enough stops being trusted to read it at all.

A false positive in insider threat is not an ethical mishap to apologize for. It is a technical failure, and it is expensive in the one currency the discipline cannot print: credibility.

The reflex, when a signal like this fires, is to narrow. Confirm the policy that triggered, close the case, move to the next alert. Narrowing feels efficient, and it feels safe, because the less you look at, the less you have to weigh. But a case read narrowly can only be read as guilt or noise, because narrowness has thrown away the one thing that separates the two: everything around the signal.

The alternative is to look at the whole picture, even the parts the triggering policy did not ask about, even when that feels like more than the case deserves. The reason is not that looking wider tends to exonerate. It does not tend toward any verdict at all, and that is the point: a reading with no thumb on the scale is the only kind that produces a verdict able to hold. Completeness is neutral. You do not examine the full context to clear someone, and you do not examine it to convict them. You examine it to understand, and understanding is what makes you ready for either outcome. Sometimes the wider view lifts the shadow. Sometimes it deepens it, surfacing something the narrow read would have missed. A practitioner who looks fully has to be prepared for both, and that preparation is precisely what makes the reading fair.

A necessary distinction, before any of this is misread. Looking at the whole picture does not mean looking at everyone, or looking whenever curiosity strikes. A legitimate investigation does not begin with suspicion of a person; it begins with an objective event that has already surfaced, a defined occurrence rather than a hunch, and it stays bounded by proportionality from there. The threshold that opens the case is also the safeguard that keeps completeness from becoming surveillance. Without that threshold, looking wider is not more thorough. It is simply more intrusive, and a reading that cannot tell those two apart is a worse reading, not a better one. What follows assumes the door was opened lawfully. The argument is about how well you read the room once you are inside it, not about the right to walk in.

So the depth that lets you clear a case and the depth that lets you build one are not two skills. They are one skill, seen from two sides. Clearing the innocent is not the soft outcome of a lenient reading. It is the hard product of a complete one. Fairness here is not mercy. It is rigor that refused to stop early.

None of this rests on the idea that insiders are mostly benign in intent. In sheer numbers they are: every serious report in the field says the same thing, the majority of insider events are careless acts, damage done without malice. That is a fact about frequency, and it is worth stating clearly. But frequency is not a discount on rigor. The thoroughness an investigation owes a case does not scale down with the odds that the person meant no harm. Read the statistic as leniency and you have made the one assumption the deliberate actor is counting on, that a program primed to expect negligence will process them as negligent. The malicious insider is real. So is the one who exfiltrates on purpose, the one who stages access quietly over months, the one who has already decided to leave and wants to take something on the way out. They are the minority, and they are precisely the reason the majority cannot set the standard.

The population is mixed, and that is the whole point. The willing employee cutting a corner and the deliberate actor covering their tracks can produce the same surface signal: data leaving through a channel it should not. What separates them is never the signal. It is the context and the intent behind it, the why. A narrow reading cannot see the why, so it makes one of two errors with equal ease. It brands the careless as hostile, or it waves the hostile through as careless. Both failures come from the same place: a picture too small to tell one from the other.

So completeness is not a courtesy extended to the innocent. It is the condition for reaching the guilty without flattening everyone around them in the process. The same depth that clears the employee who made a mistake is what isolates the one who made a choice, and a program that cannot do the first cannot really do the second. It can only suspect, and suspicion applied evenly across a mixed population is not security. It is just noise with consequences.

All of this depends on a capacity that is easy to name and hard to build: actually reading the why. It is worth being concrete about what that reading is made of, because left abstract it sounds like intuition, and it is not intuition. It runs on two engines.

The first is instrumental. The context that separates a mistake from a choice does not announce itself; it has to be reconstructed from what surrounds the signal. The sequence of actions and their order, the history of behavior the event sits against, the circumstance that makes an action ordinary or anomalous. This is technical work, the reading of instrumented behavior, and it is the part people assume can be picked up in a few weeks. The tool can. The reading cannot. Learning to see, in a trace, the difference between someone improvising under deadline and someone preparing an exit takes years, and it does not transfer from knowing the platform.

The second engine is human, and it is the one programs consistently underweight. Not every part of the why lives in the data. Some of it only surfaces in a conversation, and conducting that conversation is a discipline of its own. An interview done well is not an interrogation and not a chat; it is a controlled way of reaching understanding, rigorous about what it is testing, alert to what is not being said, capable of holding a line of inquiry without hardening it into accusation. Done badly, it contaminates the very context it was meant to clarify. This is not a soft complement to the technical work. It is the other half of the same instrument, and in the hardest cases it is the half that decides them.

These are not accessories to the discipline, skills bolted onto its side. They are the organs it perceives with, one reading the machine, the other reading the person, and a practitioner short an organ is not reading the whole case. They are seeing part of it and inferring the rest.

Return to the employee with the report due. The narrow reading goes there: sensitive content left through an unsanctioned channel, policy triggered, case closed. The complete reading starts by asking what the narrow one skipped. What surrounds the act in time: a single deadline under pressure, or a pattern of the same channel used quietly across weeks? Does the person’s history read as improvisation, or as preparation? What does the conversation, conducted properly, add that the logs alone cannot?

Follow those questions and the same opening signal can resolve in opposite directions. It can thin out into what it probably was, a shortcut taken under pressure by someone with no intent to harm, where the finding is not “cleared” as a favor but a correction of a misread, and the real exposure was a tooling gap that pushed a capable person toward an ungoverned channel. Or it can thicken. The wider read can surface what the trigger only grazed: that the deadline was a cover, that the channel had carried more than one document, that the sensitivity was understated at first glance. The point is not which way this particular case goes. The point is that only the complete reading can tell, and the narrow one would have committed to a verdict before it had the standing to reach one.

This is not a new idea, and it is not unique to security. Older disciplines of judgment arrived at the same rule long ago: no verdict before the evidence has been examined in full. The rule is not kindness toward the accused. A verdict formed early is wrong in both directions with equal ease, condemning the wrong person or clearing the right one, and the discipline of full examination is the only safeguard that works against both at once. It does not take sides. It protects the innocent and reaches the guilty through the same mechanism, the refusal to conclude on a partial picture.

An insider investigation inherits that discipline whether it names it or not. A case closed before it was complete has not been decided. It has been guessed, and a guess dressed as a verdict is indefensible in every direction: to the person under the shadow, to the organization that acted on it, and to the function that made the call.

Strong detection, in the end, is not built to catch people. It is built to understand them, and understanding is the thing that cuts both ways: it is what lifts the shadow from the one who does not deserve it, and what holds it steady on the one who does. The same depth does both. It was never a tool for catching. It was always a tool for seeing clearly, and seeing clearly is the only thing that makes a judgment fair to the person on the other end of it.

That is the vocation underneath the tradecraft. Not protecting the organization from its people, but protecting the judgment from its own errors. It is a harder and quieter kind of protection, and the person it protects most, the one being judged, is the one who never sees it.

If you do this work, or you are close to it, that last line is the one I would test against your own experience. It is the standard I have come to hold, and I would value knowing whether it holds for you.