Using Artificial Intelligence to Prevent Insider Threat

So, how can organizations prevent this increased risk of insider threat? Perhaps surprisingly, by leveraging AI itself to supercharge existing insider threat identification programs, helping to identify and prevent risks before they occur. An AI-enabled approach can be used to flag negative employee sentiment, to determine changes in digital behavior, and to reduce the likelihood of negligent insider activity.  

Negative sentiment is a frequent precursor to insider threat, as disgruntled or malicious insiders may explicitly or inadvertently communicate their intent before acting. To identify this sentiment early, use AI-enabled Enhanced Sentiment Analysis tools. These tools parse employee communications to identify signals (such as words, phrases, tonal changes) that suggest an employee is or could become disgruntled. Of course, these tools require appropriate tuning to ensure their usefulness, including tailoring keyword analytics to words or phrases most likely to indicate “risk” to the organization’s specific context. Be sure to tailor these tools to allow for “healthy” negative communication (i.e., peers blowing off steam about a frustrating coworker) to limit false positives.  

Enhanced Sentiment Analysis is especially effective when correlated with traditional insider threat identification tools, which leverage access controls to determine patterns of attempted access to assets outside an employee’s specific role purview.  

To further increase effectiveness, be thoughtful about how and where to deploy Enhanced Sentiment Analysis. Avoid the pitfall of “over-deploying” tooling across a blanket employee population. Instead take a risk-based approach: which assets have the highest criticality of the business (e.g., trade secrets, formulas, proprietary algorithms, etc.)? Who are the employees with access to those assets, or who might be manipulated by a malicious insider to provide access to those assets? Where might those insiders communicate (i.e., email, chat, collaboration platforms, possibly even social media, or fields in asset-specific tooling)? Be sure to include language disclosing the use of this tooling in communications-related policy and as part of awareness training to set expectations appropriately with employees.  

Changes in digital behavior – including attempted access escalation, high data download or upload volume, and opening thousands of files in rapid succession – can also signal an insider threat. Many types of AI-enabled tools can assist with tracking these changes. Data Loss Prevention software can identify and prevent the exfiltration of large volumes of data, leveraging AI to perform user analytics and alert on any unusual employee behavior (including repeated exfiltration attempts). File Integrity Monitoring and File Server Monitoring tools use AI not only to identify patterns in file access but also determine patterns in the timing of file access that could suggest an insider threat (e.g., after-hours access, frequent reopening, etc.). Dark Web Monitoring can identify any leaked organization data or intellectual property that may suggest an insider has performed exfiltration. These represent only a sub-set of AI-enhanced tooling useful in insider threat programs, so each organization should use their risk profile and insider threat prevention goals to inform tool selection.  

As with Enhanced Sentiment Analysis, the use of AI-enhanced tooling to identify changes in user behavior must be calibrated appropriately to reduce false positives. Similarly, these tools should be integrated with other cybersecurity technology – such as Threat Intelligence, Attack Surface Management, and Security Incident and Event Management or Security Orchestration and Automated Response tooling – to ensure that possible insider threats are not only flagged, but tracked, escalated and investigated properly against relevant user and organization data.  

The final aspect of an AI-enabled approach aims to combat negligent insiders. The fact is that employee AI use has begun and will only continue to grow. Counterintuitively, one of the best ways of using AI to prevent insider threat is by enabling its use, but with appropriate company oversight and guidance. This will not only prevent negligent activity but also reinforce best practices that reduce business risk from any technology use.  

To prevent negligent activity, organizations should consider several activities. First, provide “Enterprise” instances of popular Generative AI tools, which allow the company to dictate security, privacy, and monitoring controls. Similarly, set up and encourage the use of local instances of popular AI tools such as “copilots” and/or “sandboxes” through which employees can test AI functionality within a restricted environment. Lastly, where budget and time allow, build AI models in-house, leveraging only company data as training inputs. By allowing the use of approved AI tooling for specific activities, organizations shed light on what may currently be considered “shadow AI” or AI use occurring without company oversight. This significantly reduces the risk of negligent insider threat, as employees will be unable to inadvertently release company intellectual property and have a much more limited likelihood of generating or incorporating “bad artifacts” in their work product.  

Finally, negligence often stems from a lack of awareness, which in turn stems from a lack of governance and oversight. Implement appropriate governance mechanisms to create and enforce AI-related policies, provide oversight on decisions related to AI (and the purchase or use of AI tools on company devices), and to perform AI risk assessments to ensure the fidelity of AI tools in use. Provide role-based awareness training for employees on the secure, responsible, and ethical use of AI. Reinforce existing best practices, such as pre-publication review of all documents and quality assurance testing for all software, to catch any bad artifacts, insecure dependencies, or AI-generated “hallucinations” that may have been included.