Adaptive Security sets out insider threat programme guidance

What happened

Adaptive Security urged organisations to look beyond written policies when managing insider threats, in guidance published on its website on 18 February 2026.

The cybersecurity company, which is the original publisher of the guidance, recommends combining monitoring of systems and employee behaviour with clear responsibility for investigations. Its article is a practical guide rather than a report of an arrest, prosecution or newly disclosed breach.

It identifies five foundations for an insider threat programme: governance, an understanding of normal activity, monitoring, reporting and response procedures, and continuing staff education. The approach covers employees as well as contractors and other partners with trusted access.

Under the proposed governance model, a named lead, usually in security or risk management, would work with colleagues in IT, human resources, legal and compliance. Their responsibilities would include defining acceptable use of systems, deciding when concerns should be escalated and establishing disciplinary procedures that respect employee rights.

The monitoring recommendations bring together several kinds of technology. Data loss prevention tools help identify or restrict sensitive information being moved; behaviour analysis tools look for unusual activity; and security information and event management systems collect logs for investigation.

Adaptive Security also recommends examining training completion, responses to simulated phishing messages and whether employees have acknowledged security policies. It presents these as additional sources of information, rather than substitutes for technical evidence.

For reporting and response, the guide calls for direct or anonymous channels through which employees can raise concerns. It also recommends assigning investigation responsibilities and documenting decisions so that suspected unauthorised disclosures are handled consistently.

The background

The guide distinguishes three routes through which trusted access can create security problems. A malicious insider deliberately causes harm, a negligent insider makes unsafe decisions without intending harm, and a compromised insider has an account or device taken over by an outside attacker.

That last category connects insider risk with external attacks. An intruder using a legitimate account can appear to be an authorised user, making the account's activity important even when its owner has done nothing deliberately wrong.

This broad approach also appears in Huntress's insider risk management guidance, which covers intentional misuse, employee mistakes and stolen accounts. The distinction matters because investigating deliberate theft is not the same task as correcting unsafe working practices or responding to an account takeover.

Adaptive Security identifies remote and hybrid working as factors that can complicate oversight, with sensitive information accessed through home networks and personal devices. It also points to permissions that remain in place after people move between roles or departments, leaving them with access they may no longer need.

The company describes AI-assisted impersonation and tailored phishing as further challenges. These techniques seek to persuade someone to act on a false identity or request, potentially turning an otherwise legitimate employee action into a security incident.

Its examples include sharing a password in a workplace messaging channel accessible to contractors, disclosing credentials after a convincing impersonation call, and putting client documents into personal cloud storage. These are illustrative scenarios in the guidance, not identified incidents involving named organisations.

The focus on everyday information handling is also reflected in Mimecast's guidance on data exposure, which recommends examining file movements and account activity whether exposure is deliberate or accidental.

What people are saying

Adaptive Security says programmes can become too focused on intentional wrongdoing and investigations after damage has occurred. Its guidance argues that this can leave organisations less prepared to identify mistakes and developing patterns of unsafe behaviour.

The company lists requests for access unrelated to someone's job, repeated unsuccessful logins and misuse of credentials as possible warning signs. It also identifies changes in workplace behaviour, including reduced collaboration or expressions of resentment, as information that security teams may need to consider alongside technical activity.

According to the guide, human resources and other departments can provide context that security teams may lack, including knowledge of role changes, workplace grievances or possible burnout. It says separate departmental processes can otherwise lead to relevant information being missed and responses being delayed.

The publisher also identifies repeated failures in phishing exercises, unanswered training reminders and refusal to acknowledge revised policies as signals that programmes may overlook. It recommends ongoing education about deceptive requests and appropriate handling of sensitive information.

Adaptive Security says response procedures should reduce both missed incidents and false positives — alerts that appear concerning but do not represent a genuine threat. Its governance recommendations also call for programmes to be legally sound and consistent with employee rights.

The company promotes its own training and monitoring services within the article, including simulations of unsafe file sharing and suspicious logins. Those descriptions are the supplier's claims about its approach; the article does not present an independent evaluation of their effectiveness.

What happens next

For organisations starting or revising a programme, the guide recommends first establishing a baseline: an evidence-based picture of routine activity. Historical access records, data loss prevention alerts and phishing exercise results can help teams decide which departures from normal practice warrant attention.

The next step is to identify roles where misuse or error could have the greatest impact and decide what level of risk is acceptable. The examples include system administrators, finance employees and developers able to work on live systems, rather than treating every role as having identical access or responsibilities.

Adaptive Security recommends connecting existing security logging, human resources and training systems. The aim is to bring relevant information into established workflows rather than adding disconnected tools that make oversight harder.

It proposes reviewing incident information monthly or quarterly, checking the programme's coverage and assessing how quickly teams respond. Employee feedback should also inform changes, the guide says, so that protective measures do not create unnecessary obstacles to work.

The article sets out an ongoing management process rather than a fixed implementation deadline. Its proposed follow-up is regular revision as working arrangements, access needs and methods of deception change.