Your Newest Insider Doesn't Have a Badge

For twenty years, the security industry has organized itself around a simple assumption: an insider is a person with a badge. They have an HR file, a manager, a start date, and eventually a motive. Every insider risk program we've built, every framework, every training module, assumes there's a human on the other end of the access.

That assumption ran out of runway as soon as AI entered the game. Above Theory took this challenge head on and did what we’ve been doing to the insider risk space - offer an entirely new solution that actually solves. 

We are thrilled to announce the fruits of that research: the Synthetic Insider Threat Matrix™ (SITM). 

This is the next step in our continued partnership with Forscie, following our inaugural sponsorship of the organic version, the Insider Threat Matrix™. We believe this is a greatly needed resource as the world moves more agentic, just like it was when the original ITM was created. Real practitioners know the issues that need to be addressed, precisely why both matrices were built by practitioners.

The insider that never got onboarded

Walk through any enterprise today and you'll find AI agents holding standing access to CRM records, source code, and finance systems. They act thousands of times a day without a shift change. They were never interviewed, never onboarded, and never assigned a manager. And yet, by any definition that matters (legitimate credentials, autonomous action, the ability to move and expose data) they are insiders.

An estimated 28.6 million of these agents were active inside enterprises in 2025 and that number is projected to cross 2.2 billion by 2030. This isn’t what's coming tomorrow, this is the current state of the workforce. Most security programs don't have a category for it, let alone a way to investigate it.

Why this needed an open answer, not a product

When Forscie built the ITM, they solved something the industry badly needed: a shared, vendor-neutral language for how insider harm actually happens. That requires the community to be involved, not just a vendor or two. 

So when our research group, Above Theory, started mapping the ways AI agents create that same category of harm, but at a machine scale. The only right move was to extend the ITM itself - we already utilize the ITM in our own product, so this was a natural next step. This would provide information for the entire community, not just Above customers. 

It’s more than just the Matrix for us

Insider risk has always been an investigation problem, not a policy problem, which is the entire thesis of Above. Static rules and predefined policies drift the moment human behavior does, which is constantly. Extending that same premise to agents is just following the logic to where it actually leads.

An agent doesn't file a change request when it starts reading from a new data source. It doesn't tell you it's been extended to take an action nobody scoped it for, it just acts. If your program's only answer to "is this a risk?" is a static rule written before the agent existed, you've already lost the thread.

The SITM gives security teams the same thing the original Matrix gave them for people: a common vocabulary, a way to compare techniques across organizations, and a foundation for investigation reports that another analyst — at your company, or a completely different one — would immediately recognize.

Operationalizing the SITM

The SITM is free for any organization to use, adapt, or build on, regardless of what security stack they run. Above's own investigative agents already map behavior onto this taxonomy in production, so if you’d like to see what it looks like in your own environment, we’d be happy to help.

Twenty years ago, the industry decided an insider was a person with a badge. That was true for exactly as long as every actor with standing access to your systems happened to be human. It isn't anymore, and the Matrix needed to grow to match it.