ArticlesThe Insider Threat Practitioner Is Not a Generalist

Look at what the job seems to ask for. Detection engineering. Behavioral analysis. Employment law. Privacy regulation. HR process. Governance. Physical security. Stakeholder management. Read the list on its own and it describes someone spread thin across everything, and the field quietly concludes that this is what an insider threat practitioner is: a generalist, a jack of all trades, someone whose value is breadth.

That is the wrong reading of the list. What defines the practitioner is not how many things the job touches. It is one thing mastered deeply, and the ability to translate that one thing into the many languages the work demands. Vertical by trade, then, but horizontal by vocation: deep in a single core, and built to project it across many domains. Those are two different things, and the difference is the whole argument.

The illusion the list creates#

The list is real, and it is intimidating, which is exactly why it misleads. Faced with that many surfaces, the instinct is to look for someone who can cover all of them, and breadth starts to look like the qualification.

Rob Knowles recently mapped the field with more rigor than most, setting out the knowledge, skills, and abilities a practitioner needs across a range of concentrations and career levels. It is a genuinely useful piece of work, and it makes the breadth of the discipline visible in a way the field needed.

But a map of everything a practitioner might need to know can be read two ways. Read well, it shows the terrain. Read badly, it becomes a checklist, and the checklist tempts you toward the generalist: cover every box, know a little of each. That second reading is the trap, and it is not the map’s fault. It is what happens when you mistake a description of the terrain for a description of the person who crosses it. Whether that core lives in one practitioner or is distributed across a team is a separate question with no universal answer, but the terrain is never the person.

Why the generalist fails#

The generalist fails at the one thing the job is actually for: judgment under uncertainty.

An insider case almost never arrives as a clean fact. It arrives as a fragment. An access pattern that is slightly off. A resignation with awkward timing. A file movement that could be routine or could be the first visible edge of something. The work is not to catch an obvious event, it is to read an ambiguous signal and decide what it means before anyone can be certain. That decision is the whole craft, and it cannot be made from surface knowledge of eight domains.

Knowing a little about detection, a little about HR, and a little about law does not let you read the fragment. It lets you describe three things poorly. The generalist can hold a conversation in every room and reach a conclusion in none, because the conclusion depends on depth the generalist does not have.

And reading the fragment is only the first act. Once a signal is understood it has to be evaluated, its impact framed, and a response set in motion, and this is where the domains on the opening list finally earn their place. The same reading leads in very different directions depending on the case: a regulatory notification, a legal action, a technical hardening, a measured conversation with a manager. Choosing which, and calibrating it to what the case actually is, takes the same core that read the signal to begin with. The generalist cannot make that call either, because the trajectory depends on a judgment that breadth does not supply. Breadth covers the checklist. It does not survive contact with a real case.

What the core actually is#

Strip the list back to what is irreducible, and one thing is left: the ability to read intent and risk in human behavior, under incomplete information, through the signals that make that behavior visible.

That last clause matters, and it is where the field usually splits the craft in two by mistake. The core is not purely human, some soft intuition about people, with the technical work bolted on beside it. Nor is it purely technical, a matter of queries and thresholds with the human part left to someone else. It is the fusion. Reading intent means reading it through instrumented behavior, and the instrumentation is not a separate skill you delegate. It is the organ the core perceives with. A practitioner who cannot work the technical layer does not read intent, only data without meaning. A practitioner who has only the technical layer sees anomalies without a why. The core lives precisely where technical depth and human understanding stop being two things.

This is not a competence you improvise. It is cultivated in disciplines that have spent a long time learning to read a person through partial traces, and it transfers into this field intact. Everything else on the list can be acquired. This cannot, or not quickly, and that asymmetry is the whole point.

What the translations are#

If the core is one thing, the eight concentrations are not eight jobs. They are eight languages the one core has to speak.

The practitioner who has read a signal still has to make it usable to people who do not share the core. The same reading has to become evidence a lawyer can stand behind, a risk a business leader can weigh, a case HR can act on without overreaching, a control the engineering team can instrument. That is translation, and it is demanding, but it is not the same as competence. It is the projection of a single competence into the language of each stakeholder. Read Knowles’ concentrations this way and they stop being a checklist of things to be. They become the map of languages one core has to speak, which is a very different and far more honest picture of the job.

Note what is not on the translation list. The technical layer is not one of the languages the core projects into. It sits inside the core, next to the human read, because without it there is no reading to translate in the first place. Legal, HR, governance, and the business are the audiences. Detection is not an audience. It is part of how the practitioner sees.

What this changes#

For anyone hiring, it changes what you look for. Stop scoring candidates on how many boxes they tick, because the boxes are the learnable part. Look for the core, a real capacity to read human behavior through its signals and hold a judgment under uncertainty, and then look for the aptitude to translate it. A strong core with three missing languages is a better hire than a fluent generalist with no core, because the languages can be taught and the core cannot.

For anyone trying to enter the field, it changes what you apologize for. If you come from a discipline that reads people under uncertainty, an investigation, an intelligence function, any craft built on reading intent from incomplete traces, you may be carrying the rarest part of the job already, while worrying about the tooling gap that shows up in interviews. The tooling gap is real, but be precise about what it is. Learning a specific platform, a query language, a particular console, is a matter of weeks. Learning to read what the signals mean, to tell a pattern from noise, is not, and that was never a tooling gap at all. It is part of the core. Stop apologizing for the console you have not learned yet, and do not mistake it for the thing that actually takes years. Know what you bring, because the field needs the core far more than it needs another person who ticks the boxes.

The thread worth pulling#

There is a reason the core is worth this much insistence, and it runs past hiring.

The practitioner’s job is to read the why. Not just that something happened, but what it meant, and for whom. And reading the why has a consequence the field does not talk about enough: the same depth that lets you build a case is the depth that lets you clear one. A fragment read shallowly incriminates, because a fragment on its own often looks worse than it is. Only the full context, read by someone with the core to read it, can restore the benign explanation the person may deserve. Which means the core is not only what makes a practitioner effective. It is what makes a practitioner fair. That is a longer argument, and it is the one worth having next.