DTEX guide puts AI within scope of insider risk management

What happened

DTEX Systems says organisations should include AI tools and automated agents in insider risk management, in an online guide marked last updated 27 October 2026. Its guidance covers harm caused by anyone or anything with trusted access to organisational data.

The DTEX guide, which is the source for this report, describes insider risk management as identifying, assessing and reducing that exposure. It argues that examining behaviour can help security teams recognise warning signs before damage occurs.

The scope extends beyond employees to contractors, suppliers and partners. DTEX also includes attackers using stolen credentials, because their activity can appear to come from an authorised user.

AI creates two distinct concerns in the guidance: staff entering sensitive information into generative AI services, and automated agents moving data outside approved processes. These agents can access information and interact with other software on a user's behalf.

The guide cites the Ponemon Institute's 2026 Cost of Insider Risks Global Report, putting the average annual cost of insider incidents at US$19.5m per organisation. It also cites average annual savings of $8.2m and seven incidents avoided for organisations with an insider risk management programme.

Those figures are presented as findings from the Ponemon report, rather than evidence from a particular breach. The guide does not set out the underlying sample or calculation methods, so it does not establish what an individual organisation would save.

The background

DTEX groups insider risk into negligent, malicious, compromised and AI-related activity. Examples range from sending a sensitive file to the wrong recipient to deliberately copying customer information before leaving an employer.

The distinction affects how an incident is handled. An accidental disclosure, intentional theft and an attacker operating through a stolen account may all involve authorised access, but they do not have the same cause.

For negligence, the guide cites an annual cost of $10.3m, up 17% year on year, from the Ponemon research. It also reports that 92% said generative AI had changed how employees access and share information, although the guide does not identify the respondent group alongside that figure.

Trusted access is central to the problem. DTEX says security tools focused on keeping external attackers out may not recognise an insider's activity as unusual, while programmes limited to highly privileged users can overlook risks elsewhere in the workforce.

The company distinguishes insider risk management from data loss prevention, known as DLP. DLP controls the movement of information; the broader programme adds behavioural context, investigation and decisions about how to respond.

It makes a similar distinction for user and entity behaviour analytics, or UEBA, which identifies unusual activity by people and systems. In DTEX's account, those alerts provide inputs to an investigation rather than a complete explanation of what happened.

The guide also uses a narrower definition of insider threat, treating it as deliberate harmful activity within the wider category of insider risk. That is the terminology used by DTEX in this guidance, rather than a finding about any specific individual or incident.

DTEX is itself a supplier of insider risk technology, and the page promotes its commercial platform. Its recommendations should therefore be understood as a vendor's guidance, alongside the research findings it cites.

What people are saying

DTEX describes a five-stage process beginning with collecting metadata: information about how users interact with data, devices and applications. It recommends limiting collection to what is necessary, encrypting it and using pseudonymisation, which replaces direct identifiers with substitutes.

The next stage, according to the company, is to establish normal patterns for individual users, roles and teams. Analysts can then assess combinations of signals, including identity information, workforce context, activity records and indications that credentials have been exposed.

Investigators should see the sequence of activity rather than disconnected alerts, DTEX says. Its guidance calls for a proportionate response, with coaching for mistakes and escalation for deliberate leaks.

On governance, the company says human resources, legal, IT and security teams need a shared factual basis. Senior leadership should also be involved, with responsibilities made clear when the programme is established.

DTEX recommends deciding what information will be collected, who will be allowed to see it and how employees will be informed. It presents transparency and privacy safeguards as requirements for maintaining trust, not simply technical settings to add later.

For organisations selecting technology, the guide prioritises useful behavioural context over the number of alerts produced. It also recommends coverage of both human and AI activity, support for analysts and connections to existing security systems.

The company says technology should sit within a wider governance programme. It recommends alignment with guidance from the US National Institute of Standards and Technology, the Cybersecurity and Infrastructure Security Agency and the CERT Common Sense Guide to Mitigating Insider Threats.

What happens next

The page is an explanatory guide rather than an announcement of an investigation, regulatory action or scheduled deployment. Its next steps concern how organisations can establish their own programmes.

DTEX recommends first choosing a specific risk scenario based on the organisation's information, observed behaviour and previous incidents. Suggested starting points include departing employees, supplier access, privilege misuse, foreign interference and unapproved AI use.

It advises testing one scenario with a small group before expanding. During that pilot, teams should adjust detection rules to reduce false positives — alerts that flag activity which does not represent the risk being investigated.

Progress should be assessed through detection and containment times, investigation quality and policy outcomes, according to the guide. The Ponemon findings it cites put average containment time at 67 days, providing context for its emphasis on measuring response speed as well as detecting problems.