Diagrams and notesThree Non-Interchangeable Approaches to an Insider Program

The same components in all three. What differs is the order they are put in.

17 AUGUST 2026 | DIAGRAM

Another thought on guidance. The National Protective Security Authority (NPSA), setting the latest conceptual foundations for a shared approach to insider risk, puts the problem plainly: “Organisations adopt a narrow perspective when considering the range of potential insider events and sometimes fail to consider all the ways in which insiders can cause harm.”

That perspective follows in part from the approach a program starts from. In my experience three approaches are in use, represented below. They are different starting points, each with its own assumptions and prerequisites, not three interchangeable procedures, and none is equally suited to every context. All three share the same building blocks, but swap the order of the addends and, unlike in arithmetic, the sum changes.

Three lanes, each opened by its question. A risk-based approach, asking which exposures to address first, runs from risk assessment and gap analysis through use case validation and threat modeling to the controls, and loops back to reassess. A technology-driven approach, asking what the existing controls can detect or prevent, starts at the controls, reaches performance monitoring first, and only then validates, models, and assesses, looping back to retune. An intelligence-led approach, asking which credible threats should guide the investigation or detection priorities, starts at threat modeling, validates, assesses risk, then reaches the controls, looping back to remodel. — Open at full size

Abbreviations in the drawing: DLP, data loss prevention; UEBA, user and entity behavior analytics; SIEM and SOAR, security information and event management, and security orchestration, automation, and response; IAM and PAM, identity and access management, and privileged access management. AI-based tooling means the artificial intelligence used inside the controls, not the agents whose risk the program manages.

Framing bias at its finest.

My own take: there is no best lane in absolute terms. There is an order of operations each organization must own, chosen against its exposure, its maturity, and the threats it can plausibly identify. Still, whoever starts technology-first must, at some point, switch lanes, or at least plant one foot in risk or in threat while the other stays where it started. The difference, one could argue, is thin. It is. Foundational choices usually are, until postponed long enough for the consequences to compound.