Insider threats come in three kinds. A malicious insider takes data on purpose, often just before leaving. A careless insider shares the wrong file or pastes client data into a public AI tool. And a compromised insider is a real account being used by an attacker, which looks like the person but isn’t.
They are hard to spot because the access is real. The account is allowed to open the files; the question is whether it should be doing so now, in this amount, and sending them where it is sending them.
Signs to look for
- Large downloads, or uploads to personal accounts and AI tools, shortly before someone leaves
- Mail forwarded to a personal address
- An account suddenly gaining admin rights or opening files far outside its normal work
How Centeye handles it
Centeye Lumen sees when company data is pasted or uploaded into AI tools, including personal accounts, without reading the content. Centeye Gatewatch flags forwarding to outside addresses, accounts gaining power and sign-ins that don’t fit the person.
Gatewatch: identity threat detection →Go deeper: Insider threats: types and signs