#14.6 Insider Threat

Playbook ID: PB-INSIDER | Default severity: SEV-3 (escalate to SEV-2 on confirmed exfiltration of regulated or trade-secret data, or any privileged/Tier-0 subject; SEV-1 on active sabotage) | Owner: Incident Commander, jointly with the Legal Liaison from the first hour

#When to run this

Open this playbook when the suspected actor is someone who is supposed to have access. Triggers:

• DLP or CASB alert on bulk movement of classified data to personal storage, personal webmail, removable media, or an unsanctioned AI tool.
• Anomalous bulk retrieval the user is entitled to perform: mass OneDrive/Drive download, git clone --mirror of repos outside their team, an outsized CRM export, a database dump from an account that normally runs single-row queries.
• Activity correlated with an employment event — access spikes inside a notice period, after a performance action, or before a known last day.
• A human report: manager, colleague, ethics hotline, anonymous tip, or an external party telling you your data is somewhere it should not be. ISO/IEC 27001 A.6.8 exists because the human channel is often the only detection you get.
• Negligence: misdirected mail with regulated data, a bucket or site made public, secrets committed to a public repo, sensitive material pasted into a consumer AI service.
• Remote-worker identity failures — location mismatched against payroll, laptop shipped to an address that is not the employee's.

Not for an external actor driving a stolen credential (14.3 or 14.4 — the disambiguation is Phase 1 step 4), contractor abuse where the vendor is the risk (14.5), or an insider-authorized fraudulent payment made under social-engineering pressure (14.2).

#What you are dealing with

Every other playbook here assumes an adversary who had to break in. This one does not. The subject already holds the badge, the SSO session, the VPN profile, and — this is the part that hurts — the knowledge of exactly where the good data lives and which controls are theatre. No initial access to detect, no lateral movement, no beacon to hunt. T1078 Valid Accounts is not a step in the kill chain here. It is the whole kill chain.

Most cases are not the movie version. The dominant pattern is the departing employee taking "their" work: the rep who exports the pipeline before joining a competitor, the engineer who mirrors a repo they wrote most of. Very few think of themselves as thieves; they think of themselves as people packing a box. That belief is why the signal is so loud — own laptop, own account, business hours, no evasion — and why the human handling must be careful, because much of what looks like theft is genuinely ambiguous. The second pattern is negligence, which is more common and less interesting right up until it becomes notifiable: nobody exfiltrated anything, somebody clicked "anyone with the link," and GDPR Article 33 is triggered by a personal data breach, not by malice. The third pattern changed the numbers — Mandiant's M-Trends 2026 puts global median dwell at 14 days while internally detected dwell improved to 9, the aggregate dragged up by espionage and DPRK IT-worker cases at a 122-day median (M-Trends 2026). A fraudulently hired remote worker is an insider who was an adversary before their first standup.

The mistake teams make is running this alone. Someone sees a DLP hit, opens the subject's mailbox to "just check something," and posts a screenshot in a channel with forty people. In one afternoon you have wrecked the employment case, created discoverable material you will hate, and — if you were wrong — done real harm to someone who did nothing. Note that CISA's federal playbooks, the reference implementation for most of this chapter, contain no insider-threat content and no HR/Legal coordination path at all (CISA Playbooks).

Actionable takeaway: the Legal Liaison is engaged before the first query, not after the first finding.

#Roles for this incident

Table conventions. `TIP-OFF marks a step the subject can observe. EVIDENCE` marks a step that degrades evidence if run out of order. Do not reorder around those markers without the IC.

#Phase 1 — Detection and Triage

Covert. Nothing here may be visible to the subject.

#Phase 2 — Containment

Containment here is an employment decision with a technical execution. The two must be synchronized to the minute.

#Phase 3 — Eradication

#Phase 4 — Recovery

#Phase 5 — Post-Incident

#Decision points

#Communications and notification triggers

The clock here is a data clock, and it starts on discovery, not on proof of intent. Chapter 15 carries the full matrix; three points are insider-specific.

• GDPR Article 33 runs 72 hours from the controller becoming aware. An employee exfiltrating or misdirecting personal data is a personal data breach regardless of employment status or intent. Awareness usually lands when Phase 1 step 8 confirms which personal data moved — record that timestamp deliberately, because you will be asked to justify it.
• US state law: build to a 30-day floor for multistate exposure, with the Puerto Rico 10-day and Vermont 14-business-day AG carve-outs handled separately (Privacy Rights Clearinghouse 50-State Survey, 2026 edition).
• Internally: the subject's team notices an empty desk within the hour. Have the Communications Lead's short, factual, non-accusatory line ready before T-zero, and brief the manager on what they may not say. Route legal strategy through counsel-directed channels, not the general war room — forensic reports have repeatedly been ordered produced where privilege was assumed rather than structured (Morrison Foerster).

#Automation notes

Safe ungated — everything that gathers, nothing that acts: correlating HR lifecycle events with data-movement telemetry to raise a case rather than an accusation; firing the eDiscovery hold and short-retention log exports the instant a case opens, with hashing; generating the Phase 1 step 9 enumeration into a revocation target list that is never executed automatically; assembling a normalized UTC timeline with source and hash per entry.

Requires a human gate:

• Anything the subject can perceive — account disable, DLP block mode, device isolation, badge deactivation. You cannot un-tip-off someone. Entra re-enablement alone carries a documented 15-minute delay for SharePoint/Teams and 35–40 minutes for Exchange Online, so a wrong automated disable costs most of an hour on top of the damage.
• The revocation burst. Automate it as one reviewed script so it runs in seconds and in the right order, then put a named approver in front of the trigger, tied to HR's T-zero. Fast execution, human authorization.
• HR record access — always human, always logged, always need-to-know.
• Classification of intent. No model decides whether a person is a thief. The documented failure modes of agentic triage — overconfident closure on weak proof, and hallucinated detail in investigation narratives — are survivable on a phishing alert and catastrophic when the output is a paragraph about a named employee that lands in a personnel file.

Actionable takeaway: automate to shorten the burst, never to start it.

#Pitfalls

Takeaway: the technical half of this playbook is the solved half — preserve, scope, revoke in one burst, verify. The half that decides whether you got it right is the one where a real person's job and reputation ride on evidence that is usually incomplete. Move deliberately in Phase 1. Move fast, and once, in Phase 2. And be as quick to clear someone as you were to open the case.