AtlasInsider Risk Atlas

ATLAS-001  |  Deliberate  |  also business information

A departing relationship manager copies customer portfolio data for use at another employer without authorization

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Notice or termination date recorded in the human resources (HR) system
• Bulk download or export from the customer relationship management (CRM) system
• Email to a personal address, upload to personal cloud, copy to removable media
• Print volume above the user's defined baseline

Proposed controls

PreventSensitivity labels on customer data; data loss prevention (DLP) block on personal addresses for the departing population

DetectCorrelate recorded departure dates with customer-system exports and supported outbound-transfer or printing events

ContainThe transfer channel used restricted as soon as the movement is seen, under the incident procedure; evidence preserved and the decision recorded; account revocation on the leaving date; device return

RespondPreserve evidence of the transfer; Legal assesses recovery measures and any proposed contact with the recipients

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

MT003 and IF022.002 describe the scenario. IF010.002, IF001.001, IF002.001, and IF006.002 are the alternative channels the signals name; one of them applies in a given case.

• MT003Leaver4 detections, 6 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions
• IF010.002Exfiltration via Personal Email12 detections, 3 preventions
• IF001.001Exfiltration via Cloud Storage5 detections, 4 preventions
• IF002.001Exfiltration via USB Mass Storage Device10 detections, 3 preventions
• IF006.002Printing of Documents with Work Printer4 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Texts checked 25 October 2026. ITER

ATLAS-001, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-002  |  Negligent

An employee forwards customer records to a personal mailbox for home working, mistakenly believing that mailbox is approved for the data

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Email to a personal domain with attachments
• Repeated transfers to personal domains over a period

Proposed controls

PreventData loss prevention (DLP) policy tip and block on personal domains; an approved remote-access or data-sharing method

DetectMail-flow and data-protection events identify customer records sent to a personal mailbox; supported cumulative-transfer indicators provide context

ContainFurther transfers to the personal mailbox restricted; deletion requested, the recipient's response recorded, and residual exposure assessed; the approved remote-access or data-sharing method provided

RespondReview the handling error with the employee and the manager; record the corrective measures and assess the breach

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

MT008 applies on the stated misunderstanding, not on the forwarding alone.

• MT008Lack of Awareness3 detections, 7 preventions
• IF010.002Exfiltration via Personal Email12 detections, 3 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-002, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-003  |  Deliberate  |  also business information

An analyst exports the customer database to personal storage for unauthorized use

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Database export audit event
• Transfer to personal storage
• Deviation from the approved analytical task

Proposed controls

PreventCumulative export limits by role and domain; aggregate-only views, assessed for whether they could reveal information about individuals; data platform roles by domain

DetectCorrelate the database export and destination events with the analyst's authorized task

ContainToken and session revocation; export files still under the organization's control quarantined

RespondPreserve query and transfer evidence; assess the unauthorized access and disclosure with the data owner and the Data Protection Officer

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF045.001 applies because the use is outside any authorized purpose. A channel entry is added when the personal-storage channel is specified.

• IF045.001Unauthorized Access to Customer Data10 detections, 5 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Texts checked 25 October 2026. ITER

ATLAS-003, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-004  |  Deliberate

A human resources officer exports employee pay and performance data to an external recruiter without authorization

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Bulk reports from the human resources (HR) system without a reporting task
• Export to personal locations

Proposed controls

PreventHR system roles by population; export restricted to named roles

DetectHR system audit logs in the security information and event management (SIEM); data loss prevention (DLP) on employee data patterns

ContainExport quarantine; the export channel used restricted under the incident procedure; evidence preserved and the decision recorded

RespondPreserve the export evidence; the organization assesses the disclosure and any personal data breach, with the advice of the Data Protection Officer; Human Resources and Legal assess the misuse

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF045.002Unauthorized Access to Workforce Data9 detections, 5 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-004, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-005  |  Negligent  |  also business information

An agent sends customer personal data to an unapproved external service through an application programming interface after its owner mistakenly configures an unrestricted destination

Intent describes the owner's configuration error; the agent executes without intent of its own.

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Service principal or agent identity acting beyond the task's resources
• Transfers to destinations outside the agent's approved configuration
• The delegation chain: who started the task, which permissions it held

Proposed controls

PreventLeast privilege on agent identities; approved destinations; task authorization enforced before execution and recorded

DetectAudit of the agent's actions correlated to the principal; data loss prevention (DLP) on the outbound channel; anomaly on destinations

ContainCredential revocation; the agent paused

RespondPreserve the task, configuration, destination, and delegation record; the owner corrects the destination restriction and the Data Protection Officer assesses the disclosure

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF004.008 applies to the stated API transfer. ME030 applies where the agent runs on an enterprise-integrated AI platform. IF028 is cited provisionally for this unintended-execution variant, pending Forscie Limited's view: the entry describes human delegation.

• ME030Enterprise-Integrated AI Platforms8 detections, 10 preventions
• IF028Delegated Execution via Artificial Intelligence Agents6 detections, 4 preventions
• IF004.008Exfiltration via API4 detections, no preventions listed

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Texts checked 25 October 2026. ITER

ATLAS-005, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-006  |  Deliberate  |  also money and physical assets

A procurement officer shares confidential tender documents with a bidder through a collaboration-platform link to give the bidder an unauthorized advantage

Signals

Indicators for assessment; no individual signal establishes misconduct.

• External sharing event on the tender repository
• Bidder access to the link
• Mismatch with the authorized tender-disclosure record

Proposed controls

PreventNeed-to-know access on tender repositories; external sharing restricted

DetectSharing and download events on the tender library; data loss prevention (DLP) on bid documents

ContainLink revocation; the officer's access to the tender documents removed

RespondOpen a case with Procurement and Legal; assess whether the disclosure compromised the tender and what corrective action is required

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF001.007Exfiltration via Collaboration Platform10 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Money and physical assets. Assess the applicable fraud, payment-incident, supervisory, contractual, insurance, and criminal-reporting requirements with Finance, Compliance, and Legal. For a financial entity within DORA, operational or security payment-related incidents fall under its incident reporting as well. DORA articles 19 and 23. The asset category alone does not establish or exclude a reporting duty.

Texts checked 25 October 2026. ITER

ATLAS-006, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-007  |  Deliberate  |  also systems and operations

A departing engineer copies proprietary source code and design documents to personal cloud storage for unauthorized use at another employer

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Notice or termination date recorded in the human resources (HR) system
• Repository cloning and bulk downloads
• Upload to personal cloud storage
• Access to documentation outside the engineer's projects

Proposed controls

PreventRepository access by project; labels on security documentation; uploads to personal cloud services blocked on engineering devices

DetectCorrelate repository downloads with departure context and upload events from supported endpoint or cloud sources

ContainRepository and account revocation; device isolation if the copy is in progress

RespondRecord the material transferred; assess the exposure with Legal and the owners of the affected code and designs

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT003Leaver4 detections, 6 preventions
• IF022.001Intellectual Property Theft6 detections, 6 preventions
• IF001.001Exfiltration via Cloud Storage5 detections, 4 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-007, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-008  |  Deliberate

A manager sends confidential transaction information from the corporate mailbox to an unauthorized external recipient before public disclosure

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Access to deal documents by people outside the deal team
• Forwarding or printing of board material
• Communications with outside parties close to the announcement

Proposed controls

PreventInsider list and deal rooms with named access; labels on inside information

DetectCorrelate the mail event and the document classification with the authorized recipient list

ContainThe sender's deal room access restricted under the incident procedure; evidence preserved and the decision recorded; unauthorized sharing revoked

RespondCompliance and Legal assess the unauthorized disclosure and the issuer's obligations under the market-abuse rules in force; preserve the communication evidence

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF010.001Exfiltration via Corporate Email8 detections, 2 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Texts checked 25 October 2026. ITER

ATLAS-008, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-009  |  Deliberate  |  also personal data

After the contract ends, a supplier's technician uses an unrevoked guest account to download proprietary technical documents to personal storage without authorization

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Guest identity still active after the contract end date
• Sign-ins and downloads after the contract end date
• Unmanaged device access

Proposed controls

PreventGuest lifecycle tied to the contract, with access reviews; access from managed devices only; labels that travel with the document

DetectCorrelate guest sign-ins and downloads with the contract end date and the access-expiry record

ContainGuest account disabled; sharing links revoked; deletion requested under the contract, the supplier's response recorded, and residual exposure assessed

RespondReview access and downloads after contract expiry; assess the contractual and data protection consequences with the relevant owners

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

A live but unrevoked account does not make the use authorized.

• ME021Unrevoked AccessNo detections listed, 2 preventions
• IF039.002Access to a Retained Former Account5 detections, 2 preventions
• IF022.001Intellectual Property Theft6 detections, 6 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-009, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-010  |  Deliberate

A plant or control-room operator alters a process setting or a schedule to cause a stoppage

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Setting changes outside maintenance windows
• Changes without a work order
• Access from an unusual location or account

Proposed controls

PreventChange control with independent approval; role separation between operation and configuration

DetectOperational technology (OT) and process logs correlated with work orders; alerts on out-of-window changes

ContainSafe state restored under the operator's procedure; the operator's configuration access restricted under the incident procedure; evidence preserved and the decision recorded; manual oversight

RespondThe operations incident owner assesses the service impact, preserves process and change records, and initiates the applicable reporting assessment

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF013.002 applies where the stoppage reaches customers. IF014 applies to the setting change, not to a schedule decision alone.

• IF013.002Operational Disruption Impacting Customers15 detections, 12 preventions
• IF014Unauthorized Changes to IT SystemsNo detections listed, no preventions listed

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-010, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-011  |  Deliberate

A privileged administrator deploys a logic bomb that deletes production data after the administrator's departure

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Privileged actions after notice
• Mass deletion, backup tampering, scheduled tasks created
• Access outside working hours

Proposed controls

PreventPrivileged access management (PAM); immutable backups; privileged rights reviewed on notice

DetectCorrelate privileged changes, new scheduled tasks, and destructive execution with departure records

ContainPrivileged session termination; account disablement; restore from immutable backup

RespondPreserve the malicious code, the task definition, and the relevant logs; the incident owner coordinates recovery and Legal assesses further action

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT003Leaver4 detections, 6 preventions
• ME007Privileged Access5 detections, 3 preventions
• IF013.001File or Data Deletion7 detections, 7 preventions
• IF027.005Destructive Malware Deployment24 detections, 8 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-011, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-012  |  Negligent

An administrator makes an untested production change outside the approved change process and causes a service outage

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Change outside the change process
• Incident traced to the change

Proposed controls

PreventChange management; test environments; a second approver on production changes

DetectChange and incident correlation

ContainRollback

RespondReview the failed change, repair the approval or testing gap, and assess any reporting requirement arising from the incident's impact

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF014Unauthorized Changes to IT SystemsNo detections listed, no preventions listed

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-012, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-013  |  Deliberate

At the end of an engagement, a contractor changes access controls and creates an unauthorized administrator account to retain system access, weakening the system's security

A persistence scenario: the retained access is the impairment of security recorded here; a later act with that access is its own scenario.

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Access-control change without approval
• New administrator account without an access request
• Sign-in after the contract ends

Proposed controls

PreventContractor access through privileged access management (PAM); access expiry on the contract date; change review for third-party work

DetectChange audit on the contractor's accounts; new credential alerts

ContainAccess removal; persistence removed; exposed credentials rotated

RespondOpen an incident; involve supplier management and Legal to assess the unauthorized persistence and the applicable contractual remedies

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF014.004 applies to the access-control change. PR042 applies where the account is preparatory to later harm.

• IF014.004Modification of Access Controls1 detections, 2 preventions
• PR042Account Creation4 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-013, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-014  |  Negligent

An agent deletes production cloud resources outside its task after its owner mistakenly grants unrestricted deletion permissions

Intent describes the owner's permission error; the agent executes without intent of its own.

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Cloud resource-deletion event
• Deletion executed under the agent's identity outside its approved task
• Mismatch with the approved task and permission grant

Proposed controls

PreventDestructive rights on agent identities behind an enforced approval gate; scoped permissions

DetectAudit of the agent's actions against its task; alerts on destructive calls

ContainAgent paused; credentials revoked; resources restored

RespondPreserve the task and permission records; the owner corrects the delegation and validates a controlled test before reactivation

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF014.005 applies to the stated cloud deletion. ME030 applies where the agent runs on an enterprise-integrated AI platform.

• ME030Enterprise-Integrated AI Platforms8 detections, 10 preventions
• IF014.005Deletion of Cloud Resources3 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-014, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-015  |  Deliberate  |  also business information

A data engineer deliberately alters a dataset or model without authorization to distort the decisions based on it

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Writes to production datasets outside pipelines
• Schema or value changes without a ticket

Proposed controls

PreventWrite access through pipelines only; versioned datasets

DetectData platform audit; data quality checks correlated with writes outside pipelines

ContainAffected version preserved; writes stopped; validated version restored; access suspended pending review

RespondThe data owner identifies the affected decisions, preserves the corrupted version, and coordinates reassessment on validated data

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF040.001 applies to stored records. For a model, the card must state whether training data, parameters, or runtime output is altered.

• IF040.001Stored Record Manipulation9 detections, 6 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Data integrity. Where personal data is altered, assess a personal data breach under GDPR articles 33 and 34. Where the incident meets the significance or major-incident criteria, assess NIS2 or DORA reporting under the texts given for systems and operations. The classification of the asset as data integrity does not itself establish a notification duty. See ITER type T3.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Texts checked 25 October 2026. ITER

ATLAS-015, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-016  |  Deliberate  |  also personal data

A human resources officer alters a closed investigation record without authorization to change its findings

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Edits to records after closure
• Edits outside the officer's population

Proposed controls

PreventRecords locked after closure; human resources (HR) system roles by population

DetectHR system audit logs; edit alerts on closed records

ContainPreserve the altered record and the audit evidence; recover a verified prior version from a versioned record or a backup; the officer's edit rights on closed records restricted under the incident procedure; evidence preserved and the decision recorded

RespondOpen a case, preserve the original and altered records, and restore an approved version after the required evidence has been secured; involve the relevant case owner and the privacy function

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF040.001Stored Record Manipulation9 detections, 6 preventions
• IF045.002Unauthorized Access to Workforce Data9 detections, 5 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Data integrity. Where personal data is altered, assess a personal data breach under GDPR articles 33 and 34. Where the incident meets the significance or major-incident criteria, assess NIS2 or DORA reporting under the texts given for systems and operations. The classification of the asset as data integrity does not itself establish a notification duty. See ITER type T3.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-016, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-017  |  Deliberate  |  also personal data

A customer-facing employee changes a customer's contact details and transfers funds from the customer's account for personal gain without authorization

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Transactions on dormant accounts or on accounts of customers flagged as vulnerable under the applicable procedure
• Changes to contact details followed by transactions
• Operations outside the employee's portfolio

Proposed controls

PreventSegregation of duties; limits; customer confirmation of changes

DetectTransaction monitoring; anti-fraud rules on employee-initiated operations; audit events from the business application with a detection rule

ContainTransaction block; the employee's transaction rights restricted under the incident procedure; evidence preserved and the decision recorded

RespondThe fraud owner coordinates customer protection and recovery; Compliance and Legal assess the supervisory and criminal-reporting requirements

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF016.002Unauthorized Bank Transfers5 detections, 8 preventions
• IF040.001Stored Record Manipulation9 detections, 6 preventions
• IF045.001Unauthorized Access to Customer Data10 detections, 5 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Money and physical assets. Assess the applicable fraud, payment-incident, supervisory, contractual, insurance, and criminal-reporting requirements with Finance, Compliance, and Legal. For a financial entity within DORA, operational or security payment-related incidents fall under its incident reporting as well. DORA articles 19 and 23. The asset category alone does not establish or exclude a reporting duty.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-017, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-018  |  Deliberate

An employee creates a fictitious supplier and invoice, then approves a payment to an account they control

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Supplier master data changes followed by payments
• Same approver on creation and payment
• Supplier bank details matching an employee's

Proposed controls

PreventSegregation between master data and payment; dual approval; supplier verification

DetectCorrelate supplier creation, invoice creation, approval, and payment records; compare the approving identities and the verified account details

ContainPayment hold; recall of completed payments assessed; supplier block

RespondOpen a fraud case with Finance and Legal; assess the affected payments and the available recovery actions

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF016.006Creation of Fictitious Invoices1 detections, 8 preventions
• IF016.002Unauthorized Bank Transfers5 detections, 8 preventions
• IF044.001Unauthorized Approval6 detections, 4 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Money and physical assets. Assess the applicable fraud, payment-incident, supervisory, contractual, insurance, and criminal-reporting requirements with Finance, Compliance, and Legal. For a financial entity within DORA, operational or security payment-related incidents fall under its incident reporting as well. DORA articles 19 and 23. The asset category alone does not establish or exclude a reporting duty.

Texts checked 25 October 2026. ITER

ATLAS-018, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-019  |  Deliberate

A manager approves an inflated contract for a related supplier to divert organizational funds for personal benefit

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Undeclared related-party relationship
• Approval outside delegated limits
• Price variance against a documented comparison

Proposed controls

PreventApproval limits enforced in systems; related-party declarations

DetectEnterprise resource planning (ERP) and expense analytics; internal audit sampling

ContainThe approval rights concerned restricted under the incident procedure; evidence preserved and the decision recorded

RespondAn independent investigation owner preserves the approval evidence; Finance and Legal assess recovery and the conflict of interest

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT021Conflicts of Interest6 detections, 12 preventions
• IF044.001Unauthorized Approval6 detections, 4 preventions
• IF044.003Improper Preferential Treatment8 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Money and physical assets. Assess the applicable fraud, payment-incident, supervisory, contractual, insurance, and criminal-reporting requirements with Finance, Compliance, and Legal. For a financial entity within DORA, operational or security payment-related incidents fall under its incident reporting as well. DORA articles 19 and 23. The asset category alone does not establish or exclude a reporting duty.

Texts checked 25 October 2026. ITER

ATLAS-019, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-020  |  Deliberate

A payroll officer creates a fictitious employee record and directs salary payments to an account they control

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Employee creation outside the hiring workflow
• Payroll payment to the new record
• Account ownership inconsistent with the employee record

Proposed controls

PreventHiring workflow as the only source of employee records; dual control on bank details

DetectHuman resources (HR) and payroll audit correlation; duplicate account checks

ContainPayroll hold on the records; recovery of paid salaries assessed

RespondPayroll and Finance stop further payments and assess recovery; the Data Protection Officer assesses the data of any real person involved

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF016.002Unauthorized Bank Transfers5 detections, 8 preventions
• IF040.001Stored Record Manipulation9 detections, 6 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Money and physical assets. Assess the applicable fraud, payment-incident, supervisory, contractual, insurance, and criminal-reporting requirements with Finance, Compliance, and Legal. For a financial entity within DORA, operational or security payment-related incidents fall under its incident reporting as well. DORA articles 19 and 23. The asset category alone does not establish or exclude a reporting duty.

Texts checked 25 October 2026. ITER

ATLAS-020, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-021  |  Deliberate

A contractor uses an authorized supplier account to submit fictitious invoices, which a colluding employee knowingly approves for shared gain

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Timesheets and deliveries without a matching work order, delivery record, or acceptance
• Approvals concentrated on one person

Proposed controls

PreventEvidence-based acceptance; rotation of approvers

DetectAnalytics on invoices against system records

ContainPayment hold; recovery of completed payments assessed

RespondOpen a case covering the contractor's activity and the employee's approval; assess recovery and contractual remedies

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

MT006 and IF016.006 describe the contractor; IF044.001 describes the employee's approval, a supporting action, not the contractor's own authority.

• MT006Third Party Collusion Motivated by Personal Gain7 detections, 6 preventions
• IF016.006Creation of Fictitious Invoices1 detections, 8 preventions
• IF044.001Unauthorized Approval6 detections, 4 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Money and physical assets. Assess the applicable fraud, payment-incident, supervisory, contractual, insurance, and criminal-reporting requirements with Finance, Compliance, and Legal. For a financial entity within DORA, operational or security payment-related incidents fall under its incident reporting as well. DORA articles 19 and 23. The asset category alone does not establish or exclude a reporting duty.

Texts checked 25 October 2026. ITER

ATLAS-021, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-022  |  Deliberate

An employee looks up the records of a customer they know, with no business reason

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Access to records outside the employee's portfolio
• Lookup of a named customer without a linked case, assigned portfolio, or other recorded business purpose

Proposed controls

PreventNeed-to-know access; the reason for access recorded at lookup

DetectApplication access logs correlated with portfolio and role; alerts on named-person lookups

ContainThe affected access suspended pending review; access records preserved

RespondPreserve the access records; the responsible case owner and the Data Protection Officer assess the unauthorized access and the affected person's rights

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

MT018 applies where curiosity is the stated motive; a named-person lookup alone does not establish it.

• MT018Curiosity3 detections, 5 preventions
• IF045.001Unauthorized Access to Customer Data10 detections, 5 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-022, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-023  |  Deliberate

An administrator uses privileged access to read a colleague's mailbox or files for a personal purpose without authorization

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Mailbox or file access by an administrator outside a ticket
• Privileged access to personal workspaces

Proposed controls

PreventPrivileged access requires a ticket and a second approval

DetectAudit of mailbox access enabled; mailbox and file audit logs; alerts on administrator access to user content

ContainThe privileged access used restricted under the incident procedure; the access records and other evidence preserved and the decision recorded

RespondThe case owner preserves the evidence and assesses the misuse with Human Resources, Legal, and the Data Protection Officer under the applicable procedure

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• ME007Privileged Access5 detections, 3 preventions
• IF045.002Unauthorized Access to Workforce Data9 detections, 5 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-023, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-024  |  Deliberate

A human resources officer accesses colleagues' performance or health data outside their assigned responsibilities and without authorization

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Access outside the officer's population
• Lookups without a case or a process

Proposed controls

PreventHuman resources (HR) system roles by population; special categories of personal data behind a separate role

DetectCorrelate access to restricted employee records with the officer's assigned population and the recorded case or task

ContainThe access concerned restricted under the incident procedure; evidence preserved and the decision recorded

RespondOpen a case, assess the unauthorized access and any personal data breach, and involve the privacy function on the affected individuals' rights and the required actions

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• IF045.002Unauthorized Access to Workforce Data9 detections, 5 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-024, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-025  |  Deliberate

A manager uses employee monitoring data obtained outside the approved procedure to retaliate against an employee

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Requests for reports on named individuals
• Access to monitoring data outside the function

Proposed controls

PreventMonitoring-data access limited by role, purpose, and approved case; authorized recipients and uses recorded

DetectAudit of the function's tools; requests logged

ContainThe report stopped; access to monitoring data restricted

RespondRecord the incident and preserve the reports and the access evidence; the body designated in the mandate assesses the manager's conduct and decides the consequences, with the advice of the privacy function, and the works council is informed where it has a right to be

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF021 applies where the facts meet harassment or discrimination; retaliation alone does not establish every element of that section.

• IF045.002Unauthorized Access to Workforce Data9 detections, 5 preventions
• IF021Harassment and Discrimination6 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-025, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-026  |  Negligent

An agent generates employee scores from restricted human resources and activity data after its owner mistakenly grants access beyond the approved purpose

Intent describes the owner's access grant beyond the approved purpose; the agent executes without intent of its own.

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Agent identity reading human resources (HR) and activity data together
• Outputs about named individuals

Proposed controls

PreventPurpose limitation in the agent's permissions; no access to HR data without a decision

DetectAudit of the agent's data access by category

ContainUse of the affected outputs suspended; the agent paused; the outputs preserved

RespondIdentify which decisions the outputs influenced and which corrections are required, with the responsible owner and the privacy function

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

ME030 applies where the agent runs on an enterprise-integrated AI platform. IF045.002 applies on the stated unauthorized purpose.

• ME030Enterprise-Integrated AI Platforms8 detections, 10 preventions
• IF045.002Unauthorized Access to Workforce Data9 detections, 5 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-026, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-027  |  Deliberate

An employee instructs an agent to retrieve customer personal data outside the employee's authorized access and send it to an unauthorized external recipient

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Agent tasks that aggregate data across sources the employee cannot query alone
• Outbound transfer by the agent on the employee's instruction
• The delegation record: principal, task, permissions

Proposed controls

PreventAgent actions authorized against the principal's rights; export limits apply to the agent as to the person

DetectAgent actions attributed to the principal; data loss prevention (DLP) on the agent's outbound channel; anomaly on aggregation

ContainAgent paused and its tokens invalidated; the principal's session revoked

RespondPreserve the instruction and the delegation record; assess the unauthorized access and disclosure with the case owner and the Data Protection Officer

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• ME030Enterprise-Integrated AI Platforms8 detections, 10 preventions
• IF028.002AI Agent Privilege Exploitation5 detections, 7 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-027, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-028  |  Negligent

An operations clerk sends a shipment or payment file with personal data to the wrong recipient

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Email with a personal-data attachment to an external address not seen before
• Recall attempt or a reply from the recipient

Proposed controls

PreventRecipient confirmation for external addresses; labels that encrypt and restrict opening to named recipients; a sanctioned transfer channel

DetectCorrelate the corporate mail event, the attachment classification, the recipient history, and any user or recipient report

ContainAttempt recall or revoke document access where supported; request deletion, record the recipient's response, and assess the access already obtained

RespondAssess the personal data breach under GDPR articles 33 and 34; the designated owner determines corrective action, including any training, under the applicable procedure

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF010.001Exfiltration via Corporate Email8 detections, 2 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-028, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-029  |  Negligent

A developer sends customer records to an unapproved generative artificial intelligence service for debugging, mistakenly believing the service is approved for personal data

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Transfer to the service
• Personal-data classification of the content
• Mismatch with the approved service list

Proposed controls

PreventApproved generative artificial intelligence (AI) services with data boundaries, and the approved list published; test data in place of production data

DetectData loss prevention (DLP) on the generative artificial intelligence (AI) services the platform supports; endpoint signals

ContainStop further transfers; request removal and assess retention, access, and residual exposure

RespondBreach assessment; the handling error reviewed with the developer; the approved service list corrected where it was unclear

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT008Lack of Awareness3 detections, 7 preventions
• IF001.006Exfiltration via Generative AI Platform8 detections, 9 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-029, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-030  |  Negligent

An analyst publishes a dataset containing personal data through a public file-sharing link after selecting the wrong sharing scope

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Public-link creation event
• Dataset classification
• Access through the link

Proposed controls

PreventDefault sharing scope restricted; personal data allowed only in governed workspaces; labels on datasets

DetectPublic-link creation events on the data platform; data loss prevention (DLP) on personal data in shared items

ContainRevoke the link, preserve the access logs, and assess the downloads or copies already obtained

RespondAssess the disclosure with the data owner and the privacy function; determine any required breach response and address the sharing error

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF001.008Exfiltration via File-Sharing Platform8 detections, 5 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-030, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-031  |  Negligent

A human resources officer sends a payroll or performance file to the wrong distribution list

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Employee-data attachment to a list outside human resources (HR)
• Recall attempt

Proposed controls

PreventEmployee data shared only through the HR system; recipient confirmation on lists; labels that restrict opening

DetectData loss prevention (DLP) on employee-data patterns to non-HR recipients

ContainAttempt recall where supported; deletion requested, the recipients' responses recorded, and residual exposure assessed; access to the file revoked

RespondPreserve the mail and access evidence; the Data Protection Officer assesses the disclosure and any communication requirement; Human Resources corrects the distribution process

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF010.001Exfiltration via Corporate Email8 detections, 2 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-031, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-032  |  Negligent

A supplier's employee copies the organization's personal data to a personal account for convenience, mistakenly believing the account is approved for the processing

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Download from the shared workspace
• Transfer to the personal account
• Mismatch with the approved processing locations

Proposed controls

PreventAccess from managed devices or through a virtual desktop only; download blocked for guests; the processing agreement

DetectDownload events from the shared workspace; data loss prevention (DLP) on guest activity where the platform records it

ContainGuest access to the workspace restricted under the incident procedure; evidence preserved and the decision recorded; deletion requested, the supplier's response recorded, and residual exposure assessed

RespondThe supplier assesses the breach and, where it acts as processor and the condition is met, informs the controller without undue delay

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

MT008 applies on the stated misunderstanding. A channel entry is added when the account or service is specified.

• MT008Lack of Awareness3 detections, 7 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-032, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-033  |  Negligent

A manager forwards confidential board material to a personal mailbox, mistakenly believing that mailbox is approved for remote reading

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Board or deal documents sent to personal domains
• Labels downgraded before sending

Proposed controls

PreventAn approved reading channel provided; access or transfer restrictions enforced on board material

DetectData loss prevention (DLP) on labeled documents to personal domains; label downgrade alerts

ContainDeletion requested, the response recorded, and residual exposure assessed; the external copy's protection verified

RespondReview the handling error with the manager, and assess any inside-information implications with Compliance

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT008Lack of Awareness3 detections, 7 preventions
• IF010.002Exfiltration via Personal Email12 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Texts checked 25 October 2026. ITER

ATLAS-033, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-034  |  Negligent

An engineer leaves source code or configuration with secrets in a public repository by mistake

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Repository visibility or publication event
• Secret-scanning finding linked to the published revision

Proposed controls

PreventRepository creation policy; secret scanning; private by default

DetectPublic repository monitoring; secret scanning alerts

ContainSecrets rotated promptly, after the evidence of the exposure is preserved; repository made private or removed; forks and caches assessed

RespondThe system and information owners assess the misuse of the secrets and the disclosure; the publication controls corrected

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF001.002Exfiltration via Code Repository6 detections, 4 preventions
• IF022.006Credential Leak6 detections, 3 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Business information. The asset category alone does not determine a reporting duty. For an issuer within the Market Abuse Regulation (MAR), assess the disclosure and confidentiality of inside information under article 17 and the insider list under article 18, applying the disclosure rules in force at the time of the event. Sectoral, contractual, and other reporting duties may also require assessment. MAR articles 17 and 18. See ITER type T2.

Texts checked 25 October 2026. ITER

ATLAS-034, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-035  |  Negligent

An operator enters an incorrect control-system setting and stops the production process

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Control-setting change
• Subsequent process alarm
• Discrepancy from the approved operating setting

Proposed controls

PreventProcedures with confirmation steps; a second operator on critical settings; training

DetectProcess alarms correlated with operator actions

ContainSafe state restored under the operator's procedure; manual oversight

RespondThe operations owner reviews the error and the service or safety impact, then initiates the applicable reporting assessment

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF014Unauthorized Changes to IT SystemsNo detections listed, no preventions listed

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-035, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-036  |  Negligent

A contractor changes a configuration outside the change process and causes an outage

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Change by a contractor account without a ticket
• Outage traced to the change

Proposed controls

PreventContractor changes only through the change process; test environments

DetectChange and incident correlation on contractor accounts

ContainRollback

RespondThe service owner reviews the outage and the unauthorized change with the supplier, records the corrective measures, and assesses the reporting requirements

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF014Unauthorized Changes to IT SystemsNo detections listed, no preventions listed

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Systems and operations. For an entity within the second Network and Information Security Directive (NIS2), assess the significance of the incident under the national implementing law. Article 23 provides an early warning within 24 hours of awareness, an incident notification within 72 hours, and a final report generally due one month after the incident notification; trust service providers have a shorter notification deadline, and an ongoing incident requires progress reporting. NIS2 article 23. For a financial entity within the Digital Operational Resilience Act (DORA), assess whether the incident is major. Under Delegated Regulation (EU) 2025/301, article 5, the initial notification is due as early as possible and within four hours of classification, and in any case within 24 hours of awareness, with a specific four-hour rule for a later classification; the intermediate report is due within 72 hours of the initial notification; the final report is due within one month of the intermediate report or its latest update, subject to the exceptions and update requirements. Regulation (EU) 2025/301, article 5. See ITER type T4 for the conditions and the recipients.

Texts checked 25 October 2026. ITER

ATLAS-036, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-037  |  Negligent

An analyst accidentally overwrites a production table with incomplete data, making records used for decisions unreliable

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Write to production from a notebook
• Row count or schema change outside a pipeline run

Proposed controls

PreventProduction writes only through pipelines; versioned datasets; sandboxes

DetectData quality checks; audit of writes outside pipelines

ContainPreserve the erroneous version and the write logs; restrict further writes; restore a validated version

RespondReview the decisions made using the affected data and determine which require correction

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

IF040.001 describes record corruption; whether the entry covers accidental overwriting is a question put to Forscie Limited.

• MT016Human Error2 detections, 8 preventions
• IF040.001Stored Record Manipulation9 detections, 6 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Data integrity. Where personal data is altered, assess a personal data breach under GDPR articles 33 and 34. Where the incident meets the significance or major-incident criteria, assess NIS2 or DORA reporting under the texts given for systems and operations. The classification of the asset as data integrity does not itself establish a notification duty. See ITER type T3.

Texts checked 25 October 2026. ITER

ATLAS-037, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-038  |  Negligent

A manager overlooks missing supporting evidence when approving fictitious invoices submitted by another person, allowing fraudulent payments

Focal actor: the approving manager. Participation: enabling control failure. Fraudulent conduct: another participant.

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Approval without the required evidence
• Payment against the invoice
• Mismatch with verified delivery records

Proposed controls

PreventApproval requires evidence attached; sampling by Finance; limits enforced

DetectApproval analytics: time to approve, patterns by requester

ContainHold payments matching the identified invoice pattern pending review

RespondFinance investigates the invoice fraud and the recovery of the payments; the manager's review failure is assessed separately

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

MT016 describes the manager's oversight. IF016.006 describes the other participant's fictitious invoice.

• MT016Human Error2 detections, 8 preventions
• IF016.006Creation of Fictitious Invoices1 detections, 8 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Money and physical assets. Assess the applicable fraud, payment-incident, supervisory, contractual, insurance, and criminal-reporting requirements with Finance, Compliance, and Legal. For a financial entity within DORA, operational or security payment-related incidents fall under its incident reporting as well. DORA articles 19 and 23. The asset category alone does not establish or exclude a reporting duty.

Texts checked 25 October 2026. ITER

ATLAS-038, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top

ATLAS-039  |  Negligent

A human resources officer accidentally shares an investigation file or health data with recipients who have no role in the matter

Classification revised on 26 October 2026: from misconduct towards people to exfiltration of personal data, the focal action being disclosure, as in ATLAS-031.

Signals

Indicators for assessment; no individual signal establishes misconduct.

• Investigation files shared beyond the case team
• Special-category data in general channels

Proposed controls

PreventCase files in restricted workspaces only; labels on special categories of personal data

DetectSharing events on case workspaces; data loss prevention (DLP) on special categories of personal data

ContainRevoke access where possible, preserve the sharing records, request deletion of the unauthorized copies, and assess residual exposure

RespondThe Data Protection Officer assesses the disclosure and the communication requirements; the case owner reviews the sharing controls

Matrix references

Counts show the detections and preventions listed in Matrix version 2.13.0. They do not indicate controls implemented by an organization.

• MT016Human Error2 detections, 8 preventions
• IF022.002PII Leakage (Personally Identifiable Information)5 detections, 12 preventions

Implementation

Signals require contextual assessment. Detection depends on available source events and tested rules. Technical controls must be supported by the chosen platform and validated in the organization’s environment. Configuration, approvals, and operating procedures are organization-specific and outside the scope of this Atlas.

Reporting assessment

Applicability depends on the incident, the organization, its role, the affected services and people, and the applicable jurisdiction. An asset is an input to the assessment, not a legal trigger by itself. Each affected asset is assessed; each obligation applies only when its own conditions are met.

Personal data. Where a personal data breach occurs, the controller documents it under General Data Protection Regulation (GDPR) article 33(5). Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. Article 34 requires communication to them without undue delay where the risk is likely to be high, subject to its exceptions. A processor informs the controller without undue delay after awareness. Unauthorized access can constitute a breach without extraction. GDPR articles 4(12), 33, and 34. See Insider Threat Event Requirements (ITER), types T1 and T5.

Texts checked 25 October 2026. ITER

ATLAS-039, revised 26 October 2026, Insider Risk Atlas version 1.0.1Back to the top