The film

Organizations prepare for the attacker who breaks in. Fewer are prepared for the person causing harm from the inside, with a badge, a laptop, and every right to be there.

I’m Alessandro Aledda. After a career as an officer in the Italian Army, in human intelligence and counterintelligence, I built the insider threat function of a large European bank.

Today I design and run these functions for organizations of similar scale, under GDPR and the applicable requirements of NIS2 and DORA.

An insider, deliberately or by mistake, can expose data, disrupt systems, divert money, or harm colleagues, and AI agents that act under their own identities now belong in the same picture. Their access is legitimate, so harm travels through the same actions as daily work, and telling the two apart takes context that systems rarely capture.

An organization can fail in two ways. It misses the harm, and learns of it from a client, a regulator, or a competitor. Or it watches without method, and breaches the law and the trust of its own people.

That is why no single tool or function manages insider risk alone: detection, investigation, and response involve Security, Legal, Human Resources, the Data Protection Officer, and the business, under privacy and employment rules that vary from one European country to another.

I provide five services, end to end or at any point in an existing program.

I design the program with the functions that share the risk: the mandate, what it may lawfully observe in each country, and who decides what.

I engineer detection and prevention on the organization’s own risks: from a map of those risks to use cases, and from use cases to detection logic on the platform already in place, such as Microsoft Purview, calibrated on its own data.

I build a procedure from alert to case closure: triage, investigation within agreed limits, containment, evidence collected and documented for any proceedings that may follow, and whether an event must be reported, to whom, and by when.

I run the function alongside the team that will take it over, and train the analysts who will run it.

And where a program already runs, I assess it: what it covers, whether its controls operate as intended, and which gaps to close first.

I work independently, inside the organization, alongside the multidisciplinary teams who will own the program. I help define the problem and its solution with clarity, and I stay through implementation and handover, until the insider threat team runs the function on its own. The decisions stay with the organization; I leave the record that supports them.

If you are building this function, or you are responsible for protecting your organization’s information, people, and assets from insider risk, I would welcome a conversation. The first step is to establish what your organization needs; the solution is designed around it.