Ask most security leaders how mature their insider risk program is, and you’ll likely get a confident answer. Ask them to defend it with evidence-based reasoning, and they may be less confident.
The insider risk surface is widening faster than most programs can match. This is primarily driven by two technology trends: generative AI, which creates new pathways to sensitive data; and AI agents, which possess access to real systems yet are not typically treated with the same caution as human insiders. Workplace modernization developments, such as distributed teams as well as shifting physical and digital perimeters, amplify these insider risks.
Adding Signals Only Adds Complexity
The instinct when a new risk appears is to buy a new tool, which is precisely the problem. Most organizations already run Data Loss Prevention (DLP), next-generation DLP, and User & Entity Behavior Analytics (UEBA) at once. With this model, each layer simply adds more for the team to monitor, because reviewing signals requires human judgement.
More tools do not automatically mean your program is more mature. Instead of adding more signals into an already overflowing pot, organizations need a program that focuses on increasing investigation efficiency. That’s where the insider risk maturity model comes in.
One Maturity Model, Five Levels, One Continuous Climb
Proper insider risk management requires people, process, and technology:
- People: A single accountable senior official, usually the CISO, supported by a multidisciplinary group across security, HR, legal, IT, and data owners.
- Process: Governance via a documented investigation and incident-response workflow with a clear escalation chain, disposition authority, and privacy guardrails.
- Technology: Five capability levels based on the dominant decision model your program runs on. Most organizations operate between levels one and three.
Moving up the levels doesn’t necessarily mean new tools but rather using your tools as inputs to investigations. The five levels are:
Level 1: Data Control
DLP determines whether a document is sensitive and headed out the door but has no indication of who’s involved or why.
Level 2: Telemetry & Visibility
At this stage, organizations gain more details on what happened during an incident, but that only generates more data for human judgement.
Level 3: Behavioral Baselining
UEBA flags what’s unusual for a user. However, most organizations get stuck here. Identifying abnormal behavior doesn’t lead to an immediate verdict, it creates a question that adds yet another layer.
Level 4: Behavioral Investigation
This is the inflection point. The system hands over investigations, not flags, along with a verdict and evidence. For example, a user’s late night login to protected systems so they can meet an impending deadline wouldn’t be an issue; but if that same activity led to the user downloading source code and sending it to an external email address, it would be investigated. The system leverages context rather than merely detecting behavioral deviation.
Level 5: Organizational Risk Intelligence
Systems identify business processes and workflows that create opportunities for malicious insider activity before incidents occur. Very few, if any, programs have reached this stage.
This model applies to managing both human and AI insiders. The only difference is the vocabulary needed to answer those questions, which is why the Synthetic Insider Threat Matrix (SITM) is a critical resource for today’s security teams. The SITM provides a shared way to describe how a synthetic actor becomes capable of harm, not just that it did.
Summiting the Climb
Advancing beyond Levels One and Two is about governance, not technology. Name one leader who is able to own the entire program, which tends to fall under the remit of the CISO, and convene the cross-functional group that owns insider risk with HR, legal and IT. The charter and privacy guardrails must be established before writing a single detection rule.
Moving through Level Three means resisting the urge to declare victory prematurely. Baselining feels like progress because it produces so much output, but it isn’t progress if a human still needs to triage alerts and review verdicts. This level is where most organizations with an insider risk program are at today, largely because of what tooling has been traditionally available.
Jumping to Level Four is when an organization’s economics truly change. This is when the initial notice that lands on an analyst’s desk is a complete verdict with cited evidence. The mean time to investigate and resolve shrinks, while the ratio of investigations to alerts grows. The team of decision-makers who sign off on verdicts also expands to include security, HR and legal. These leaders need a shared vocabulary for verdicts to understand the impact on personnel and legal decisions.
The final stage, Level Five, isn’t a checkbox to chase right now. Instead, organizations should focus on reaching Level Four, while treating Level Five as the direction the insider risk program is heading. Eventually, well-run programs will reach the level where informal business processes that drive risk are caught before they can be exploited.
Stand Above the Rest by Not Getting Stuck
Most stuck programs aren’t failing for lack of data. They’re simply not realizing that possessing more data and tools doesn’t make strategy or execution more intelligent. Identifying your organization’s current level is the first step toward the summit.
The cost of staying stuck isn’t abstract, and it isn’t a future risk. A program stuck at Levels One or Two will catch policy violations but miss the insider who’s walking out the door with sensitive information if policies weren’t broken. Analysts operating a program at Level Three burn hours chasing anomalies searching for a needle in the signal noise haystack. None of these first three levels even touch shadow business practices, which is where the most deadly risk lies.
Every quarter a program spends treating AI agents as someone else’s problem is a quarter of agentic activity, with real access, accumulating outside the one system built to catch it. None of that is a future risk. It’s the current cost of stopping the climb at Level Three and calling it good enough.