An insider does not need to break anything. The logins, queries and file moves that make up an incident are each allowed. In its 2026 Cost of Insider Risks report, the Ponemon Institute puts the average incident at 67 days to contain and the average annual cost at $19.5 million per organization.
Insiders
CISA defines an insider as anyone who has or had authorized access to an organization’s resources, and an insider threat as the potential to use that access to do harm, intentionally or not. That covers employees, contractors, suppliers and an outsider holding their credentials. The same Ponemon report splits incidents three ways.
Negligent, 53 percent
A person with legitimate access moves data to the wrong place, the wrong recipient or the wrong tool. At $10.3 million a year, this is the largest share of the cost.
Malicious, 27 percent
A person with legitimate access uses it to take, alter or destroy what they were trusted with.
Compromised, 20 percent
An outsider holds an employee’s credential and uses it as the employee would. The login itself is clean.
Data
Most insider incidents are files moved by people who were allowed to open them, and there is no malware to find afterwards. The control has to sit where the file leaves.
ARRTECH DLP inspects content before Send and controls USB, clipboard, print and screen capture. Sender and recipient rules cover departing employees and accounts that have left. A supervisor can approve an exception, files leave under company-key encryption, and every action is attributed to a named person.
ARRTECH SIEM signs the record, so HR, legal or an outside party can verify the evidence chain without trusting the team that produced it.
Detection
Each action passes policy, so a rule that describes a known attack has nothing to match. What changes is the pattern: a rare authentication path, drift from an account’s own baseline, or reach into systems and accounts it does not normally touch.
Cyberdroid AI Detection, part of the Cyberdroid SOC Platform, the AI layer of the ARRTECH Security Suite, measures each user, host and application against its own history and its peers across five telemetry families: identity, network, DNS, process and firewall. It reads what ARRTECH SIEM, or a third-party SIEM with a supported export, already holds, read-only, each hour after the hour closes. It is near-hourly.
Every finding carries the observed value, the baseline it departed from, the score and the threshold crossed, with an ordered evidence timeline.
Response
Disabling an account, revoking a session or preserving a mailbox is a decision about a person, and it belongs to people. Detection never blocks or changes anything. A person approves, and ARRTECH SOAR runs the playbook, with every decision recorded. A risk score is a prioritization aid, not a verdict.
Evaluation
A proof of value runs beside your existing controls on labeled replay scenarios and at least one representative week of your own telemetry. Detection overlap and gaps, evidence completeness, precision and time to a defensible disposition are scored against a scorecard agreed before it begins.
Schedule a meetingSources
Products
Inspects content before Send, controls USB, clipboard, print and screen capture, and attributes every action to a person.
Collects, signs and correlates logs from every source, with a risk score per user on a timeline.
Cross-source behavioral detection on your SIEM: identity, network, DNS, process and firewall telemetry, baselined against each entity’s own history.
