By Matt Erickson

Security teams have good reasons to monitor IT networks for unusual downloads, inappropriate access, and attempts to move sensitive information out of an organization. But what happens when the first meaningful warning is a conversation that never touches a corporate network?

A foreign intelligence officer can recruit an employee through social media. A criminal group can offer to buy access rather than steal it. Both exploit something a network diagram cannot adequately describe: the relationship between a person with legitimate access and someone who wants to use it.12

We call this an insider threat because of the access being abused. That does not mean the threat develops entirely inside the organization.

Recruitment does not require a network intrusion

Consider Jinchao Wei, a U.S. Navy sailor assigned to the USS Essex. In February 2022, a Chinese intelligence officer approached him through social media, initially posing as a naval enthusiast working for a Chinese shipbuilding company. Eight days later, Wei told another sailor that he suspected he was being targeted in an intelligence operation. The contact wanted information about naval maintenance and ship locations and was offering payment.1

His friend recommended deleting the contact. Instead, Wei moved the conversation to another encrypted messaging application and began spying, eventually supplying thousands of pages of technical and operational information.1

Recruitment was a security problem before the documents left the ship. An approach that waits for suspicious file transfers starts partway after that story begins.

Nor is this limited to espionage. In March 2022, Microsoft documented LAPSUS$ advertising its interest in buying credentials from employees of targeted organizations. Microsoft also reported successful intrusions into U.S. firms through recruited employees, including people working for suppliers and business partners.2

A public offer to pay your staff for access is intelligence about a threat to your organization, even before you know whether anyone has accepted payment. This activity cannot be discovered by examining your own authentication logs alone.

Sometimes the motive is an audience

Not every insider needs a foreign handler or a financial incentive. An online audience can matter, too.

Jack Teixeira, the former Air National Guardsman, searched for classified information unrelated to his duties and shared national defense information on Discord. The Justice Department described his repeated disclosures as an effort to impress online friends.3

There were internal warning signs. The Air Force’s Inspector General found that personnel failed to take appropriate action after becoming aware of his classified material-seeking activities, although the Inspector General did not find evidence that his supervisory chain knew about the unauthorized disclosures themselves.4

That combination matters. The internal activity showed inappropriate interest in classified information. The external activity showed where that information was going and the audience it served. Together, they describe the threat more fully than either fact alone.

These cases do not establish that public-source monitoring could have accessed private conversations or guaranteed prevention. They establish something more basic: important parts of an insider threat can develop outside the IT an organization controls.

Why behavioral analytics, rather than just more monitoring?

Finding a leaked document is useful, but it means a disclosure has already occurred. The larger opportunity is to understand developing troubling behavior, not simply discover the aftermath.

Consider the difference between discussing a technical subject, advertising privileged access, and offering to supply internal material. These are not interchangeable behaviors. Their sequence, the responses they attract, and their connection to someone’s actual responsibilities can change the significance of what an analyst is seeing.

That is the role outside- the company’s IT infrastructure behavioral analytics can fill: connecting relevant activity over time and relating it to the access to assets or information an organization needs to protect. A collection of posts is not, by itself, an assessment. The value comes from understanding how the evidence fits together.

Internal monitoring remains essential. But a record of someone opening a document cannot, by itself, explain whether they are doing their job, responding to a legitimate external request, or something troubling, like collecting classified material to impress an online audience. External evidence can help distinguish between those possibilities. It can also give security, and counterintelligence teams a reason to examine activity that might otherwise appear routine.

The value is not confined to predicting a first offense. Identifying a recruitment campaign before one of your employees is compromised, recognizing an offer to misuse access, or detecting an early disclosure before more material leaves your secure spaces are all important objectives.

The perimeter is not the whole problem

The case for external behavioral intelligence is not that everyone broadcasts an intention to betray their employer. It is that a program designed to understand insider threats should not exclude relevant evidence simply because it originates beyond the network.

We need to know more than whether a credential is valid or a download is unusual. We need to understand the security-relevant behavior surrounding that access. Social media can be part of that evidence, not merely be the venue where a breach eventually becomes public.123

The firewall is a useful boundary for a network. It should not be the boundary of our understanding.

Footnotes

  1. U.S. Attorney’s Office, Southern District of California, “U.S. Navy Sailor Sentenced to More Than 16 Years for Spying for China”, January 12, 2026, updated January 14, 2026. ↩ ↩2 ↩3 ↩4

  2. Microsoft Incident Response and Microsoft Threat Intelligence, “DEV-0537 criminal actor targeting organizations for data exfiltration and destruction”, March 22, 2022. See the introduction and “Initial access” discussion of advertised recruitment and successful access through recruited employees. ↩ ↩2 ↩3

  3. U.S. Department of Justice, “Former Air National Guardsman Sentenced to 15 Years in Prison for Unlawfully Disclosing Classified National Defense Information”, November 12, 2024. ↩ ↩2

  4. Secretary of the Air Force Public Affairs, “Results of Investigation into A1C Texiera’s Unit following unauthorized disclosure of classified documents”, December 11, 2023. The spelling “Texiera” appears in the source’s title. The release predates Teixeira’s guilty plea and federal sentencing. ↩

← Explore more perspectives