By Matt Erickson
The argument for outside-the-firewall behavioral analytics is straightforward: we need to recognize relevant conduct and relationships that internal security systems cannot see. The next question is what we do with that information.
We need these tools to connect observations and direct investigative attention. We do not need them to decide who has the wrong opinions or who is destined to commit a crime.
Taking analytics seriously means treating their findings as something to examine, not something to obey. An alert can be valuable without being a verdict.
An unpopular opinion is not an insider threat
An employee can dislike management, oppose government policy, or express views that colleagues find objectionable without intending to steal information or harm anyone. Our security practice should not treat disagreement as evidence of betrayal.
Consider two hypothetical posts. One criticizes an employer’s government contract. The other offers to sell restricted files from that project. The first expresses an opinion. The second describes potential misconduct that warrants verification. An analysis that treats both as equivalent “negative sentiment” misses the distinction that matters.
Carnegie Mellon’s Software Engineering Institute has explicitly cautioned that there is no single “insider personality” and warned against overinterpreting what text analytics reveal. Understanding someone’s attitudes is not the same as establishing what they have done or will do. (SEI)
Beliefs may help explain the context of conduct. They should not become a substitute for evidence of a threat. A program that confuses ideological conformity with trustworthiness is policing “thoughtcrime,” not protecting an organization.
A forecast is not a finding
The argument for external behavioral analytics is straightforward: a company needs to recognize relevant conduct and relationships that internal security systems cannot see. The next question is what we do with that information.
We need these tools to connect observations and direct investigative attention. We do not need them to decide who has the “wrong” opinions or who is destined to commit a crime.
Taking analytics seriously means treating their findings as something to examine, not something to obey. An alert can be valuable without being a verdict.
An unpopular opinion is not an insider threat
An employee can dislike management, oppose government policy, or express views that colleagues find objectionable without ever intending to steal information or harm anyone. Our security practice should not treat disagreement as evidence of betrayal.
Consider two hypothetical posts. One criticizes an employer’s government contract. The other offers to sell restricted files from that project. The first expresses an opinion. The second describes potential misconduct that warrants verification. An analysis that treats both as equivalent “negative sentiment” misses the distinction that matters.
Carnegie Mellon’s Software Engineering Institute has explicitly cautioned that there is no single “insider personality” and warned against overinterpreting what text analytics reveal. Understanding someone’s attitudes is not the same as establishing what they have done or will do. (SEI: https://www.sei.cmu.edu/blog/considerations-for-deploying-a-text-analytics-capability-for-insider-threat-mitigation-part-1-of-3/)
Beliefs may help explain the context of conduct. They should not become a substitute for evidence of a threat. A program that confuses ideological conformity with trustworthiness is policing “thought crime,” not protecting an organization.
A forecast is not a finding
The same boundary applies to “future crime.” Identifying a concerning pattern does not establish that someone will complete a harmful act. The FBI’s behavioral-analysis guidance cautions that no single behavior establishes that a person is on a path toward targeted violence, while recognizing that combinations of concerning behaviors may justify attention. (FBI: https://www.fbi.gov/how-we-investigate/behavioral-analysis)
A numerical score does not eliminate that uncertainty. An 85 out of 100 on an insider threat scorecard does not automatically equate to an 85 percent probability of wrongdoing. NIST’s AI Risk Management Framework emphasizes evaluation against realistic conditions, including false positives and false negatives. A score should be interpreted according to what has actually been validated. (NIST: https://airc.nist.gov/airmf-resources/airmf/3-sec-characteristics/)
That cuts both ways. A low score is not a clean bill of health, and a quiet dashboard should not override credible contrary evidence. SEI has specifically warned that apparently positive employee sentiment can create false reassurance. This cautions against analytics alone establishing guilt or certifying innocence. (SEI)
The investigation must do more than confirm the alert
Suppose a monitoring tool flags an apparent offer to provide insider access. The next step should be to establish what the evidence clearly supports. Is the account actually associated with the employee? Does the full conversation mean what the excerpt suggests? Does the person have the access being advertised?
Just as importantly, what would show that the interpretation is wrong? The post might quote someone else’s solicitation, describe a research exercise, or come from an impersonator. Those are possibilities to test, not reasons to ignore the lead. A sound investigation must be capable of resolving a concern in either direction.
Corroboration also needs to be independent. Three systems summarizing the same post does not represent three independent sources. They provide three interpretations of one source.
The larger practice should bring external observations together with relevant access records, employee reports, interviews, and other lawfully obtained evidence. CERT’s insider-risk guidance places technology within an enterprise-wide program involving security, human resources, legal counsel, and other responsible teams. Buying the tool is not the same as establishing an insider threat program. (SEI: https://www.sei.cmu.edu/blog/the-13-key-elements-of-an-insider-threat-program/)
Nor should “human review” mean having someone rubber stamp whatever the model recommends. Reviewers should examine the underlying evidence, consider alternative explanations, and have the authority to reject the assessment. Their job is to test the conclusion, not supply it with a human signature.
Prevention is still the objective
None of this requires waiting for someone to cause harm before acting. An article in the FBI’s Law Enforcement Bulletin draws the useful distinction: warning behaviors can help focus an investigation and guide timely intervention without predicting violence. (FBI Law Enforcement Bulletin: https://leb.fbi.gov/articles/perspective/perspective-identifying-warning-behaviors-of-the-individual-terrorist)
An employee targeted by a recruiter may need a protective briefing rather than an accusation. A credible imminent threat may require urgent protective action while facts are still being assembled. Neither situation requires pretending that software has proved someone guilty. The response should reflect the evidence, the urgency, and the potential harm.
Those of us building these tools should be clear about that division of responsibility. Their value should be measured by whether they help investigators identify meaningful concerns, test explanations, and act appropriately, not by how many people they label dangerous.
We need behavioral analytics because relevant evidence does not organize or explain itself. We need investigative discipline because a pattern is not a verdict.
The goal is better-informed judgment, not judgment by algorithm.