Above Security Team
Jul 09, 2026
Above Security Team
Jul 09, 2026
Many of us at Above came up through offensive security, breaking into companies for a living, and the pattern that stuck with us is simple: the break-in was never the hard part to catch. What we did once we were inside, with legitimate access, looked like ordinary work. That is the whole problem with insider risk, and it is why buying one more detector rarely moves the needle.
Most security tools are detectors. They watch a surface, learn what normal looks like, and raise a hand when something drifts. That was a reasonable design fifteen years ago. It is a poor fit for insider risk, because insider incidents are not built from anomalies. They are built from ordinary actions, taken by trusted people, that only mean something when you read them in order. A detector gives you more alerts. Insider risk needs judgment.
So when a security leader asks us for the “best insider risk platform,” we push back on the question. The better question is what you should demand from any approach, whether you build it, buy it, or stitch it together from tools you already own. Below is the rubric we use. Ten questions. Score your own stack honestly and the gaps will tell you more than any vendor comparison. If you only take one idea from this piece, take the frame: insider risk is an investigation problem, not a detection one.
An anomaly tells you behavior changed. It does not tell you why, and the why is the entire question. People deviate for a hundred ordinary reasons: a promotion, a launch, a red-eye flight, quarter-end. Deviation is not intent, and a broken policy is not proof of one. A platform that stops at “this is unusual” hands you a triage problem, not an answer. This is the line between anomaly detection and investigation, and it is exactly what UEBA was always supposed to be.
Ask your stack: when something looks off, does it explain why it matters, or only that it happened?
An insider incident is one human story scattered across identity, SaaS, endpoint, and now AI. The export in Salesforce, the login in Okta, the paste into a personal chatbot are three isolated alerts in three consoles and one investigation in reality. If your tools cannot connect them into a single timeline, a person has to, by hand, and most of the time no one ever gets to. The whole point is to collapse the stack into one investigation that draws on every system you already run.
Ask your stack: can it assemble one timeline across identity, SaaS, endpoint, and AI, or does correlation happen in an analyst’s head?
Every team we meet is drowning in alerts that arrive with no context. The usual fix is to tune thresholds until the noise is bearable, which also tunes out the real signal. False positives are not a tuning problem, they are a context problem. When you can see the whole sequence, the ambiguous alert resolves itself, because context is what separates a careless paste from a coordinated exfiltration.
Ask your stack: does it cut noise by understanding the situation, or by raising the bar until quiet, real things slip through?
“Insider” is not one thing. A compromised account, a negligent employee, and a malicious insider can produce the exact same log line and demand completely different responses: reset the credentials, coach the person, or open a case with legal. Only behavior over time separates them. A tool that flattens all three into a single risk score forces your team to redo that analysis on every alert.
Ask your stack: can it distinguish a hijacked account from a careless user from a deliberate actor, from behavior rather than a single score?
Pre-departure data theft is the most predictable insider pattern there is, and still the most missed, because the signals arrive before anything obviously bad happens: the job application, the shift in access patterns, the quiet staging of files. By the time the resignation email lands, the exfiltration is usually already done. The value is in reading the path early, not confirming the loss afterward.
Ask your stack: does it surface behavioral flight-risk signals early enough to act, or only reconstruct the theft after someone has left?
The newest insider on your network is not a person. AI agents now act on employees’ behalf with delegated, entirely legitimate access, reading Drive, Slack, and CRM at machine speed. They are a new kind of insider that lands in exactly the same blind spot as the human one, and an agent holding your OAuth token can move faster than any employee. An insider program that only models humans is already behind.
Ask your stack: does it reason about agent behavior and human behavior inside the same investigation, or ignore agents entirely?
Most risky behavior is not malicious, it is a good employee about to make a mistake. Blocking them breaks the work and teaches people to route around security. A better response meets the person at the moment of risk with lightweight, real-time guidance, so a bad week never has to become an incident. Hard enforcement still matters for real threats, but coaching is what changes the base rate.
Ask your stack: can it guide a user in real time before a mistake, or is the only move to block, or to alert after the fact?
Watching people is a serious act, and an insider program that ignores that will not survive contact with legal, HR, or a works council. The answer is not to monitor less, it is to design for privacy: minimize what is exposed by default, open a person’s content only under an authorized role, and log every look. Done right, privacy and coverage stop being a trade-off and start reinforcing each other, because a defensible process is one the business trusts enough to actually run.
Ask your stack: can it investigate behavior without blanket surveillance, with access controls and an audit trail built in?
The fastest-growing insider surface is the one you never approved: personal AI accounts, unsanctioned SaaS, browser extensions, OAuth grants no one reviewed, and credentials leaving through channels your DLP never watched. Data escapes through these paths precisely because no console is pointed at them. Coverage that stops at your sanctioned stack is coverage of the wrong map.
Ask your stack: can it see shadow AI and unsanctioned SaaS usage, or only the tools you already know about?
The output of insider risk work is not a flag, it is a decision that HR or legal can stand behind. That means a finished narrative: what happened, in order, with the evidence attached and the intent assessed, ready to hand off without a week of manual reconstruction. If the “result” is a high-severity alert that still needs a human to build the story, the hard part has not been done. The case should arrive already assembled.
Ask your stack: does it hand you an investigation-ready case, or an alert that someone still has to turn into one?
Run your current setup against these ten. Most stacks do well on the first layer, detection, and come apart on correlation, intent, and defensible output, because those were never what detectors were built to do. That gap is the real state of insider risk in 2026. It is not a missing product on the shelf, it is the absence of a program that can read the whole book. We built Above to be that reader, but the rubric stands on its own. Use it on us too.
UEBA is good at flagging that behavior changed. Insider risk turns on why it changed, which means reading behavior in context across systems and reaching a defensible judgment about intent. UEBA is a useful input, not a complete program.
Add context instead of raising thresholds. Most false positives are alerts stripped of the surrounding story. When you correlate the full sequence of behavior, ambiguous events resolve on their own, and you cut noise without muting real signal.
They can look identical in a single log. A compromised account is a legitimate identity driven by an outside attacker; a malicious insider is the legitimate user acting against the organization. Only behavior over time reliably tells them apart, and each calls for a different response.
Treat agents as insiders. Track the access they were granted, the OAuth scopes they hold, and what they actually do with that access, and reason about their behavior in the same investigation as the humans they act for.
Yes, if privacy is designed in. Minimize what is exposed by default, gate access to a person’s content behind an authorized role, and log every review so the process stays auditable and defensible for HR and legal.
Detection was the last decade’s problem, and the industry solved it many times over. Insider risk is an investigation problem, and it rewards a different kind of tool: one that reads the whole story, weighs intent, respects the person, and hands you a case you can act on. Stop buying detectors. Start holding your program to the standard above.
