Identifying Insider Threats Before And After They Become Threatening Insiders

Pythia Cyber's co-founder Brendan recently posted about insider threats. An insider threat is someone who can cause damage, either unintentionally or through negligence or through deliberate malice. There is a cottage industry regarding insider threat especially in law enforcement and intelligence work.  

We at Pythia Cyber are in the behavioral cybersecurity arena. As much as insider threat, which are behaviors, affects the risk management of cyber-systems, we address insider threat. But unlike the cottage industry we focus on identification before a potential threat actor is hired as well as after, and our tools review both employees and managers.

It is critical to start, before getting to discussing insider threats, by asking you what a threat is. 

Brendan mentioned unintentional damage (threat): knocking something over, unplugging a system, etc. That's a talent and performance management issue.

Then there is negligence: not auditing logs, not being current in or following policies, not updating equipment, etc. That's a performance management issue and probably also a developmental issue.

Threats arise when systems and policies are not followed, or people are hired into positions that they are not talented for. Maybe these employees have not be developed to handle new systems. In other words, these threats arise from corporate issues, not entirely from employee issues.

Did you think that corporate human capital deficiencies were "insider threats"? Indeed they are.

What about "bad guys"?

At the employee level, which is where 99% if not 100% of cottage industry insider threat work is focused, people engage in bad behavior usually due to monetary gain, self-aggrandizement, and political vendetta ("my people deserve better"). But two things have to happen for employees to become threats. First, there usually are increasing pressures (typically financial) that overwhelm the person's capacities, and this act seems like the answer. 

Second, there is a triggering event that leads to a sentiment that "they owe me." 

Almost universally this triggering event is due to poor or inadequate supervision.

A recent piece over at Harvard Business Review by Doug Reynolds and Steve Rogelberg is key. In "How to spot a toxic leader -- before hiring them," Reynolds and Rogelberg discuss how "toxic corporate culture is 10.4 times more powerful than compensation in predicting employee turnover, making it the single strongest predictor of attrition during the Great Resignation."

Toxic leaders are talent, performance management, and engagement problems. These are "people issues" that are entirely within the realm of behavioral cybersecurity.

Reynolds and Rogelberg continue. They point to a meta-analysis of the causal impacts of toxic leadership. In that study by Li, Yin, Shi, Damen, & Taris (2023), toxic supervision at time one (first measurement) is highly predictive of toxic leadership at time 2 (second measurement). Well, no head scratcher there other than this is a performance management and developmental issue for the organization. Similarly, bad employee behavior -- maybe it's pre-toxic but definitely aberrant -- is highly predictive of aberrant behavior at time 2, again, no head scratcher -- talent and performance management issues for the organization.

Here's the fun part from Li et al. Toxic leadership at time 1 is not predictive of aberrant employee behavior at time 2, but aberrant employee behavior at time 1 is predictive of toxic leadership at time 2.

Yes that's right, leaders can be goaded into retribution. And given the power differentials and spans of control, it is pretty likely that the impacts of this toxicity affect more than one target employee.

You, o skeptical reader, might try to brush this off with some thought like "But of course that happens because we put worse employees with worse leaders!" That sounds a lot like another problem with corporate human capital.

That's where we can help.

Pythia Cyber's BARC instrument is designed to identify destructive leaders. Our talent assessments are designed to weed out those with less aptitude for success. Our policy reviews check on performance management deficiencies to address those negligence and accidental issues at both employee and supervisor levels. Our leadership team development aligns all the functional human capital parts to create a high-performing workplace.

What are you waiting for -- someone to engage in destructive behavior?

Ask us how we can help you address insider threats before and after hire.

(image credit: Rjcastillo, CC BY-SA 4.0 <https://creativecommons.org/licenses/by-sa/4.0>, via Wikimedia Commons)