Above Security raises $50M to redefine insider risk in the age of AI agents
Read more
%201.svg)
Few organizations historically have been able to afford to build and operate a world-class insider risk management team, but with Above Security, we think everybody is going to get the effect of a highly trained AI capability that can deliver this effect.
Many tools out there that give you the breadcrumbs of suspicious activity, but they don’t give you the full picture. What we really loved about Above Security is its ability to take a wide-ranging set of sensory capabilities and use AI to build that complete narrative of activities that are inherently high fidelity.
Above Security has also taken great lengths to make sure there’s near zero false positives, which enables highly reliable risk ranking of the true positives—so teams can efficiently respond to the right events in the right way.
Cybersecurity leader, Partner at Ballistic Ventures, and former CISO, Google Cloud
Partner, Ballistic Ventures
The insider threat is one of the biggest and prioritized risks especially when you deal with international companies and ongoing M&As. Above security was a great match for zero fales positives with the right privacy controls in place to deal with the right threats without exposing us to new threats in other domains.
Most tools surface anomalies. Above surfaces context. That distinction is critical when making high-stakes decisions involving people, data, and risk.
Our SIEM, CASB, DLP, and EDR were completely blind to this. Above caught early departure signals and risky data access patterns we'd never seen before. Not after the fact, but while it was happening.
.png)
This is the power of agentic AI applied correctly: every organization can now have the effect of a highly trained insider risk investigation team, continuously learning, adapting, and evolving.
In cybersecurity, an insider is someone or their AI agent with authorized access to the organization’s systems, data, or physical infrastructure. Insiders can include full-time employees, part-time staff, contractors, and business partners or third-party vendors, any of whom may access confidential data. AI agents or other identities with access all fall into the insider category.
Insider risk is the all encompassing umbrella of potential risk and exposure of an organization due to an identity with authorized access. Whereas insider threats have been seen mainly as malicious, insider risk includes every day business risk that arises as a result of employees and their agentic counterparts doing their jobs. This can include an employee clicking on a phishing link leading to credential theft, a highly permissioned AI agent without proper guardrails, and everything in between. It is a metric that has traditionally been difficult to quantify due to how wide the risk surface is, and ineffective tooling up until now.
An insider threat is a security risk arising from an identity with legitimate access to sensitive data, systems, or facilities. While external threats must compromise security settings or exploit configuration errors, insider threats are allowed to access internal systems which makes identifying abnormal data movement difficult.
The five types of insider threats are:
Insider threat cases are uniquely dangerous because:
A malicious insider threat is someone who intentionally uses their authorized access to compromise the organization’s security. Their deliberate actions seek to cause harm by stealing intellectual property or sensitive information for:
An accidental insider threat arising from people who have no intent to cause harm but still inadvertently compromise sensitive information. Typically arising from human error or employee negligence, these insider threats can still lead to data breaches, like when an employee accidentally emails sensitive data to the wrong recipient. According to research, 68% of breaches involve the human element, meaning they arise from non-malicious actors.
Detecting malicious and accidental insider threats requires organizations to recognize subtle behavior shifts that allow them to mitigate risk. Some early indicators might include:
Yes. Unintentional insider threats are the most common type. Typically, these cyber acts arise from employee negligence like:
Shadow IT consists of IT systems, devices, software, web-based applications, and services that people use without the IT department’s explicit approval. Increasingly, shadow AI has become a subcategory of shadow IT risk. Even when organizations approve a specific AI agent, insiders can create risks when they use personal accounts, creating a shadow AI risk. For example, employees may use generative AI tools to improve productivity. However, if a prompt includes confidential data, then it may be an unauthorized disclosure that leads to a data breach or incident.
Insider threats can happen in various ways, including:
Some examples of user activities that are accidental threats include:
Most organizations use traditional data loss prevention (DLP) or user and event behavior analytics (UEBA) tools to mitigate insider threat risks. However, to reduce data leak and security breach risks, organizations need to understand user behavior by connecting telemetry derived from:
Social engineering attacks manipulate people into sharing confidential information or taking actions that compromise security. By exploiting human psychology, attackers trick people into ignoring security protocols, like downloading malicious software or sharing credentials.
