SentinelOne sets out how to detect and prevent insider threats

What happened

SentinelOne has set out guidance on detecting insider threats within organisations, covering deliberate wrongdoing, mistakes and accounts controlled by attackers, in an online article marked as updated on 23 September 2026.

The cybersecurity company, which published the guidance on insider threats, says legitimate access can make harmful activity difficult to distinguish from ordinary work. Its recommendations combine restrictions on access, monitoring, staff training and procedures for removing access when people leave.

The publication is an explanatory guide rather than an announcement of a new breach or prosecution. It draws on several US cases to illustrate how trusted access can be used to steal information, disrupt systems or support an outside attack.

One example concerns a developer at an Ohio power management company whom a federal jury convicted in March 2025. According to SentinelOne’s account of the prosecution, he planted disruptive code after a 2018 reorganisation reduced his access.

The code included instructions that would run repeatedly without stopping and a mechanism linked to his own account. When the company dismissed him and disabled that account, the mechanism prevented employees worldwide from accessing systems, the guide says.

A separate example concerns overseas operatives accused of using stolen American identities to obtain remote IT jobs at more than 100 US companies. SentinelOne cites charges announced by the US Justice Department in June 2025, describing alleged access to source code and defence information subject to export controls.

These examples concern different stages of employment: obtaining a trusted role and misusing access before departure. They illustrate why insider-risk controls extend beyond checking whether a person has a valid login.

The background

The guide defines insider threats by the access involved, rather than by employment status alone. Employees, contractors, vendors and former staff whose accounts remain active can all fall within its scope.

It identifies three main categories. A malicious insider deliberately steals information, sells access or damages systems; a negligent insider causes harm through carelessness or error; and a compromised insider has an account or device controlled by an outside attacker.

That last category does not imply wrongdoing by the account holder. An attacker using stolen credentials can appear to be an authorised employee while operating with that employee’s permissions.

SentinelOne uses the 2024 Change Healthcare attack to illustrate this distinction. It says attackers entered a remote-access portal using a legitimate employee’s credentials and spent nine days moving through internal systems before deploying ransomware, which can lock organisations out of their data and systems.

The guide also cites Tesla’s 2023 notification to Maine regulators concerning the exposure of personal records belonging to 75,735 current and former employees. According to SentinelOne, Tesla’s investigation identified two former employees who had passed the information to a news outlet.

Technical monitoring therefore needs to consider what happens after a successful login. A connection accepted by an authentication system establishes that the supplied credentials work; it does not establish that every subsequent action is appropriate.

Terminology also differs between publishers. Earlier DTEX guidance distinguishing insider risk from insider threat puts greater emphasis on intent, separating accidental exposure from deliberate harm. SentinelOne uses insider threat more broadly to include both.

The potential consequences extend beyond stolen files. The guide identifies fraud, corrupted or destroyed data, interrupted services and disclosure of intellectual property as possible outcomes, with financial, legal and reputational effects for organisations.

What people are saying

SentinelOne says no individual warning sign establishes that an insider threat exists. Its guidance separates changes colleagues might notice from evidence recorded by technical systems, and recommends assessing activity against a person’s usual working pattern.

The company identifies unusual download volumes, access outside normal hours, repeated attempts to reach sensitive resources and unexpected changes to security settings as reasons for review. It recommends combining information from account authentication, remote connections and access records rather than relying on one source.

To support that process, SentinelOne recommends user and entity behaviour analytics, commonly shortened to UEBA. These tools establish typical patterns for people and devices, then flag departures from those patterns for investigation.

On the Change Healthcare attack, the guide cites testimony by UnitedHealth’s chief executive to the US Senate Finance Committee confirming that the affected portal lacked multi-factor authentication. This requires an additional form of verification beyond a password.

SentinelOne also says negligence is less visible in court records than deliberate misconduct. Its guidance argues that prosecutions often reconstruct events after damage has occurred, whereas monitoring is intended to identify suspicious activity earlier.

The publisher says employee monitoring must be balanced against privacy rights and legal requirements. It recommends shared responsibility across security teams, human resources, legal advisers and organisational leadership, rather than treating insider risk solely as a technical problem.

What happens next

The guide does not announce a new enforcement action or provide a timetable for further proceedings. Its next steps concern how organisations assess and manage their own exposure.

SentinelOne recommends first identifying the systems, information and physical locations that matter most, then prioritising protection accordingly. This gives organisations a basis for deciding where access restrictions and closer monitoring are most important.

Access should be limited to what each role requires, an approach known as least privilege. The guidance also recommends reviewing permissions regularly, separating sensitive responsibilities between people and removing access promptly when employment or a contract ends.

Training should cover password handling, deceptive approaches designed to obtain information or access, and ways to report suspicious activity. SentinelOne includes contractors and third-party vendors in that work, reflecting their potential access to organisational systems.

Written policies should explain acceptable use and the handling of privileged information. Alongside those rules, the guide recommends incident-response procedures covering reporting, investigation, identification of the underlying cause and corrective action.

The combination of technical controls and safeguards for staff also appears in earlier Microsoft guidance on insider risk management, which addresses accidental exposure, deliberate misuse and compromised accounts while recognising employee privacy. Together, the guidance illustrates a broader approach to trusted access that considers people and working practices alongside security software.