Use Case: Insider Threat
Insider data theft
A senior engineer downloaded 40,000 source code files 3 days before their last day. HR had notified security. ManySignal had already flagged the access spike when the notification arrived.
The data walk-out you didn't see coming
The Waymo v. Uber trade secrets lawsuit (2017), the Apple v. Rivos case (2022), and dozens of undisclosed corporate trade secret thefts follow a pattern: an employee, typically in a technical role, downloads a substantial portion of their work product in the days or weeks before resignation. They use legitimate access — the files are in systems they're authorized to use — and legitimate tools: the web browser, the company laptop.
The behavioral signal is clear in hindsight: a spike in file access volume, unusual hours, files outside the user's normal working set, and in many cases a simultaneous spike in personal email or cloud storage activity. ManySignal's behavioral baseline makes this pattern detectable in real time rather than after the fact.
rule: insider_data_theft_risk
type: behavioral + hr_correlation
sources:
- microsoft_365_audit
- google_workspace_drive
- sharepoint_audit
- dlp_events
- hr_system (departure_flag, pip_flag)
trigger:
- condition: |
file_access_volume_7d > user_baseline_p95 * 2.5
AND (departure_flag == true OR insider_risk_score > 70)
- OR:
- condition: |
dlp_policy_match AND egress_type IN [personal_email, removable_media, personal_cloud]
enrichments:
- data_classification: purview, nightfall, custom_tags
- hr_status: resignation_date, pip_status, manager_id
- behavioral_delta: 30d_access_pattern_change
- itsm_justification: jira, servicenow
mitre: T1078 (Valid Accounts), T1213 (Data from Information Repositories)Has the user's file access volume spiked relative to their 90-day baseline?
Behavioral baselineWhat is the data classification of the accessed files — PII, IP, financial, operational?
DLP / PurviewIs the user on an HR watch list, a PIP, or a known departing employee?
HR integrationDid the user access files outside their normal working hours?
Activity timelineWere files copied to removable media, personal cloud storage, or emailed externally?
DLP / EDRHas the user's manager or HRBP been notified through standard HR channels?
HR systemAre there open ServiceNow or Jira tickets justifying this access?
ITSM integrationEnable enhanced DLP monitoring for the user's account — log all file activity for 30 days
Approve-gatedAlert the user's direct manager and HR business partner with sanitized evidence summary
Approve-gatedPlace a legal hold on the user's email, SharePoint, and OneDrive data
Approve-gatedGenerate forensic timeline of all file access and egress events for legal review
AutonomousIf removable media involved: coordinate with IT to enable USB block policy
RecommendMITRE ATT&CK mapping
Insider data theft FAQ
How does ManySignal handle the legal complexity of monitoring employees?
ManySignal's insider threat workflow includes guardrails specifically designed for the legal sensitivity of employee monitoring. Evidence is collected under attorney-client privilege workflows where configured, alerts go to designated insider threat team members only, and the platform maintains an audit trail of who accessed the investigation data.
What's the difference between insider data theft and departing employee risk?
Departing employee risk focuses on the access window between resignation and account deprovisioning. Insider data theft is a broader category that includes current employees with no stated intent to leave. The behavioral signals differ: departing employees show a one-time spike; malicious insiders often show gradual escalation over weeks.
Can ManySignal detect insider activity that doesn't involve file downloads?
Yes. Insider data theft also manifests as screen captures, photographing screens (if the DLP solution supports camera detection), mass email forwarding, CRM data viewing without saving, and database query patterns that suggest reconnaissance rather than normal work. All these signals feed the insider risk score.
How are false positives handled given the sensitivity of these allegations?
The insider threat workflow requires explicit analyst approval before any action that could affect the employee — monitoring, holds, or notification. Automated actions are limited to evidence preservation only. The workflow enforces two-person authorization for escalation steps.
Detect the data walk-out before the last day
HR-correlated behavioral DLP with built-in legal workflow guardrails.