The Other Half of the Insider Investigation: Above × Nisos

Every insider investigation eventually runs into the same wall: how do these actions fit together?

You can see the sequence of actions: the repository cloned at an odd hour, the customer list exported to personal storage, the credentials shared into a third-party AI tool. What you don’t have is the reason. Human behavior is driven by reason, and without it, you’re guessing at intent, which is the one thing an insider case actually turns on.

The context that explains intent usually isn’t inside your environment at all. It’s outside it: a second job that was never disclosed, financial pressure, or a role change that didn’t go the way someone hoped. Activity in the open digital world is the thread that connects the disparate events inside the ecosystem, and it reframes everything the behavioral timeline is showing you.

That half of the picture has traditionally lived on a different team, in a different tool, in a different case file. Today we’re closing that gap.

What we’re announcing: Above × Nisos Ascend™

We are proud to announce the integration between Above’s Arbiter engine and Nisos Ascend™. Joint customers now get one investigation-ready view of the person at the center of an insider-risk incident via Nisos’ external human-risk intelligence and Above’s in-environment behavioral analysis, in the same case, at the same moment.

Nisos is the leader in human risk intelligence and digital investigations. Founded by former intelligence community professionals, Nisos pairs analyst-led tradecraft with AI-powered technology to surface risk that lives outside the perimeter — where traditional security tools, background checks, and internal monitoring can’t see. Above’s fleet of autonomous AI investigators reason continuously over user behavior across SaaS, identity, endpoint, and AI environments to determine intent.

Together, we extend the investigation beyond what security teams thought was possible.

Insider risk was never an alerting problem

This integration follows directly from how we think about the category.

The most damaging incidents often don’t originate from an attacker defeating the perimeter. Even when the threat is external, social engineering and other tried-and-true TTPs rely on insiders to get in. These incidents come from people who already have legitimate access and are doing things that look, signal by signal, entirely permitted. That’s why rule-based tooling struggles: there’s no policy violation to fire on, just a sequence that means something only when you read it as a whole.

A mature program has always drawn on both external intelligence and internal behavioral detection. The problem was never that teams didn’t know they needed both. The problem was that combining them meant a second login, a manual lookup, and copying names between dashboards. These friction points are exactly what gets skipped when a case is moving fast.

So we put the external context where the case is already being worked.

How it works

Setup happens inside the Above platform and takes minutes, once.

From there, you decide which incidents automatically trigger a Nisos investigation, such as critical incidents or anything high-severity or above. Once the integration is connected, every Above incident gains a Nisos Ascend™ panel for the person at the center of the case. Analysts see, without leaving the incident view:

• Investigation status, executive summary, and monitoring summary from the latest Ascend™ report 
• Risk indicators across categories Nisos monitors, including sensitive company data exposure, undisclosed outside employment, sentiment analysis, concerning social media activity, and indicators of violence
• Monitoring alerts surfaced from social media and the public web
• One-click access to the full investigation in Ascend™ 

The analyst gets the external picture at the moment it changes their read of the internal one.

What changes for your team

The practical difference is in how fast and confidently a case resolves.

An export to personal cloud storage is ambiguous. An export to personal cloud storage by someone with an undisclosed outside employment indicator is a different case entirely, and it’s one you can act on. Our investigators now weigh internal behavior and external context together, which means fewer cases that stall in “suspicious but unexplained,” and fewer escalations that turn out to be nothing.

“Insider risk is an investigation problem, not an alerting problem. Our AI investigators already reason continuously over what people do across a company’s environment to determine intent. Nisos adds a powerful new dimension to that investigation: the signals that signify risk outside of an organization’s digital walls. Now our investigators weigh internal behavior and external context together, in a single case, so security teams reach sharper conclusions faster. This integration brings a stronger investigation for our joint customers, giving security teams much needed time and resources back.”

 Aviv Nahum, Chief Executive Officer, Above Security

“Insider risk doesn’t start when someone logs in — it starts long before a security team ever sees an alert. Pairing Nisos Ascend™’s external human-risk intelligence with Above’s revolutionary AI investigators gives analysts the full picture of the person, not just the activity. Above was already redefining how organizations approach insider risk, and this integration closes the gap between what happens outside a company’s walls and what happens inside them. Our joint customers can now move from suspicion to certainty faster than ever before.”

Ryan LaSalle, Chief Executive Officer, Nisos

Available today

The Above × Nisos integration is live now for joint customers of both platforms and can be enabled immediately from within the Above platform.

Already running both? Turn it on and your next incident will carry the full picture.

Want to see it in your environment? Request your own version of Above’s insider risk report — or learn more about Nisos Ascend™.