September is National Insider Threat Awareness Month, a joint initiative of the Cybersecurity and Infrastructure Security Agency and the National Counterintelligence and Security Center. It was established to help organizations recognize and respond to insider threats — employees, contractors, and partners who misuse access to organizational systems and data.
The initiative addresses a real problem. Insider threats account for a meaningful proportion of significant data breaches. Access that was granted legitimately is a different challenge than access that was obtained through external attack.
The initiative’s response to this real problem is worth examining carefully.
What the Program Recommends
NITAM guidance consistently recommends that organizations establish formal insider threat programs with specific capabilities: user behavior analytics, monitoring of privileged access, data loss prevention systems, and employee training to recognize and report concerning behavior.
The technical stack for a mature insider threat program — UBA platforms, DLP systems, endpoint monitoring, privileged access management — is substantial and expensive. The primary beneficiaries of NITAM’s awareness campaign are vendors who sell these products.
This is not a coincidence. NITAM operates similarly to cybersecurity awareness programs in other sectors: government legitimacy combined with vendor ecosystem benefits. The National Cybersecurity Alliance runs Cybersecurity Awareness Month with similar dynamics. Government and industry partners promote awareness; industry partners sell awareness-motivated purchases.
The Surveillance Scope Problem
Insider threat programs are surveillance programs. This is not pejorative — it is definitional. The program monitors what employees do on organizational systems, with whom they communicate, what data they access, and how their behavior changes over time. This monitoring is what allows the program to detect misuse.
The problem is that “insider threat” is a category that can be defined very broadly or very narrowly, and how it is defined determines what the surveillance covers.
Narrow definition: individuals who are actively stealing data, sabotaging systems, or facilitating external adversaries. This is the threat that insider threat programs were designed to address. It affects a small percentage of employees and is usually detectable through existing access controls and anomaly detection with appropriate tuning.
Broad definition: anyone whose behavior deviates from baseline in ways the monitoring system flags. This includes disgruntled employees who haven’t done anything, people organizing around labor issues, whistleblowers who are legally protected from retaliation, employees with mental health challenges that manifest as irregular work patterns, and people who are simply having a difficult personal period.
Mature insider threat programs with sophisticated behavioral analytics are very good at flagging the broad category. They are less good at distinguishing between the small subset that represents genuine security risk and the larger population flagged by behavioral deviation.
What Happens to Flagged Employees
When an insider threat program flags an employee, someone has to do something with that flag. In most organizations, that means HR, legal, or a manager gets a report about the employee’s behavior patterns, and a conversation or investigation follows.
The employee does not know the investigation is occurring. They do not know they have been flagged. They experience the investigation as unexplained management scrutiny, changed access, or HR conversations with no stated reason.
For the small proportion of flagged employees who are genuine security threats, this process is appropriate. For the majority of flagged employees who are not security threats, this process causes documented organizational harm: decreased job satisfaction, decreased trust in management, decreased willingness to report concerns through official channels, and increased attrition among employees who are otherwise performing well.
The harm to the majority of incorrectly flagged employees is not tracked. The insider threat program’s success metrics measure detected threats and prevented incidents. They do not measure the organizational cost of surveillance applied to employees who posed no threat.
The Reporting Culture Problem
One of the most consistent findings in insider threat research is that organizational culture — specifically, whether employees trust that reporting concerns will be taken seriously and won’t result in retaliation — is the strongest predictor of whether potential threats are identified early.
Organizations with high-trust reporting cultures identify insider threats through human observation: colleagues who notice behavioral changes and feel safe reporting them, managers who follow up on expressed concerns, HR processes that treat early reports seriously. This is cheaper than enterprise UBA platforms and more effective at early identification.
Organizations that invest heavily in surveillance technology often simultaneously underinvest in the cultural conditions that make human observation functional. The technology looks like a solution that doesn’t require the harder work of building trust.
NITAM guidance includes cultural recommendations — promote a speak-up culture, establish psychological safety for reporting — alongside the technical recommendations. In practice, the technical recommendations dominate because they produce clearer procurement decisions and measurable program artifacts.
Bottom Line
Insider threats are real. Organizations with access to sensitive systems and data need to think carefully about how that access is controlled and monitored. The monitoring needs to be proportionate to the actual risk and implemented in ways that don’t systematically damage the organizational culture that is the most reliable early-detection mechanism.
National Insider Threat Awareness Month is good at promoting insider threat awareness. It is less good at promoting careful thinking about surveillance scope, false positive rates, and the organizational costs of treating the workforce as a threat environment. Those questions are worth asking before you buy the monitoring platform NITAM’s vendor ecosystem is promoting.