---
title: "INSIDER THREAT RESEARCH GROUP"
url: https://insiderthreatresearch.com/
description: "A reference manual on insider risk: the four types of insider threat, warning signs, programme design, access controls, monitoring limits and incident response."
---

# INSIDER THREAT RESEARCH GROUP

The CISO Guide to Managing Insider Threats

Reference manual · nine chapters and a glossary

## Fresh entries

[01**How to Choose Performance Management Software for Goal Tracking: A Buyer's Guide**Oct 16, 2026](https://insiderthreatresearch.com/how-to-choose-performance-management-software-for-goal-tracking-a-buyer-s-guide/)

[02**How Much Do the Best Tools for WhatsApp Broadcast Messages Cost in 2026**Sep 28, 2026](https://insiderthreatresearch.com/how-much-do-the-best-tools-for-whatsapp-broadcast-messages-cost-in-2026/)

[03**How to Choose the Cheapest WhatsApp Business API Provider in 2026**Sep 21, 2026](https://insiderthreatresearch.com/how-to-choose-the-cheapest-whatsapp-business-api-provider-in-2026/)

[04**IT Support in West Palm Beach for Local Businesses**Sep 14, 2026](https://insiderthreatresearch.com/it-support-west-palm-beach-definitions-examples-and-next-steps/)

[05**Top 7 Alternatives of PerformYard for Goal Management**Sep 14, 2026](https://insiderthreatresearch.com/top-7-alternatives-of-performyard-for-goal-management/)

[06**What Are the Best Nintex Alternatives for Operations Teams?**Sep 13, 2026](https://insiderthreatresearch.com/what-are-the-best-nintex-alternatives-for-operations-teams/)

[07**5 WhatsApp Business API Platforms Worth Shortlisting for Third-Party Integrations**Sep 10, 2026](https://insiderthreatresearch.com/5-whatsapp-business-api-platforms-worth-shortlisting-for-third-party-integrations/)

[08**Why Is Heyramp the Best for Simple Pulse Surveys?**Aug 29, 2026](https://insiderthreatresearch.com/why-is-heyramp-the-best-for-simple-pulse-surveys/)

[09**Koala AI vs Autoblogging.ai for Bulk Content Automation**Aug 27, 2026](https://insiderthreatresearch.com/koala-ai-vs-autoblogging-ai-for-bulk-content-automation/)

More

[10**TaskRio vs Tasks.Bot for Zapier Alternative AI Automation**Aug 15, 2026](https://insiderthreatresearch.com/taskrio-vs-tasks-bot-for-zapier-alternative-ai-automation/)

## Scope of the guide

This manual treats insider risk as a management subject rather than as a category of alert. It covers how the exposure is created by ordinary decisions about access, how it is bounded by design rather than by observation, what monitoring can and cannot establish, and how a suspected case is handled without destroying the record that later has to justify the response.

The four kinds of case — sabotage, fraud, intellectual property theft and accidental exposure — are kept apart throughout, because they have different motives, leave different traces, and are stopped by different controls. Chapters are written as reference rather than as news, and each carries an applicability line stating who it was written for.

## Start here

1. 01[What insider risk means](https://insiderthreatresearch.com/what-insider-risk-means)Why the standing exposure and a specific actor are different problems.
2. 02[The four types of insider threat](https://insiderthreatresearch.com/types-of-insider-threats)Sabotage, fraud, intellectual property theft and accidental exposure.
3. 03[Warning signs and what they are worth](https://insiderthreatresearch.com/warning-signs)Observations that justify a look, and why they are not a test.
4. 04[Building an insider risk programme](https://insiderthreatresearch.com/building-a-programme)The four scope questions to settle before any tooling is chosen.

## Reviewing an access request

The most frequently repeated procedure in this manual, reproduced here because it is the decision that determines how large any later incident can be.

1. Establish which tier the material sits in before considering the requester.
2. Confirm the task the access is for, and confirm it is the requester's task.
3. Grant the narrowest scope that completes the task, not the scope that was asked for.
4. Set an expiry for anything above role-standard access, and record the approver.
5. Record what was refused as well as what was granted, so the pattern of refusals is reviewable.
6. Bind removal to the next role change rather than to a future review date.

## The four types at a glance

*Table 0.1 — Category, motive, evidence trail and the control that most often catches it*

| Category | Motive | Evidence trail | Control |
|---|---|---|---|
| Sabotage | Grievance or retaliation | Privileged change outside change control | Segregation of duties |
| Fraud | Direct personal gain | Small repeated transactions | Reconciliation and maker-checker |
| Intellectual property theft | Taking work onward | Bulk collection then bulk movement | Egress review at the leaver point |
| Accidental threat | None — error or haste | A single misaddressed action | Interface design and a safe reporting route |

Chapter 2 takes each category in turn. The [glossary](https://insiderthreatresearch.com/glossary) defines the vocabulary used across all nine chapters.

## On this page

1. Scope of the guide
2. Start here
3. Reviewing an access request
4. The four types at a glance
5. Where to go next