Skip to content
ENExplore Calculators

Insider Threat Risk Calculator

Score insider risk from access breadth, privilege, monitoring, behavioural indicators, departure status and data value.

About Insider Threat Risk Calculator

Insider risk is opportunity multiplied by impact, adjusted by motivation. Opportunity deliberately combines what the person can reach with how poorly it is observed, because unmonitored access is what turns capability into unattributable loss. Motivation uses only objective, defensible signals — employment status and observed behavioural indicators — and is capped at 3×. This is a prioritisation estimate for where to apply monitoring, not a judgement about any individual. The single biggest insider variable is not privilege, it is whether anyone would notice: unmonitored administrative access to a customer database is a loss you discover from a news article.

Formula

Insider Threat Risk

risk = (opportunity × impact ÷ 10) × motivationMultiplier, where opportunity = mean(access breadth, privilege, monitoring gap, DLP gap) and impact = data sensitivity plus a record-volume uplift.

opportunity
How much the person can reach and how unobserved they are
impact
What the reachable data is worth if taken
motivationMultiplier
Employment status scaled by observed behavioural indicators

Worked example

With the default values below, Insider Threat Risk Calculator returns Insider Risk Band of Critical — act now. Change any input above and every figure here is recalculated in your browser.

Inputs used

Systems the individual can reachone of One application — 2, A team's systems — 4, A whole business unit — 6, Estate-wide — 9
A whole business unit — 6
Privilege levelone of Standard user — 3, Elevated application rights — 5, System or database administrator — 8, Domain or cloud tenant administrator — 10
System or database administrator — 8
Sensitivity of reachable dataone of Public or internal only — 2, Commercially sensitive — 5, Regulated personal data — 8, Source code, keys or the customer database — 10
Regulated personal data — 8
Monitoring of that activityone of Full session recording and UEBA alerting — 1, Logged with periodic review — 3, Logged, never reviewed — 5, Not logged — 9
Logged, never reviewed — 5
Behavioural indicators observedaccepts 0–20 indicators
2 indicators
Employment statusone of Settled, no notice — 1.0×, Under performance management — 1.3×, Serving notice or resigned — 1.5×, Terminated with access not yet revoked — 2.0×
Serving notice or resigned — 1.5×
Egress and DLP controlsone of Blocking DLP on all egress paths — 1, DLP on email and web only — 4, Monitor-only DLP — 5, None — 9
Monitor-only DLP — 5
Records reachableaccepts 0–1,000,000,000 records
500,000 records

Results

Insider Risk Band
Critical — act now
Insider Risk Score
9.07 / 10
Opportunity
6.00 / 10
Impact
9.00 / 10
Motivation Multiplier
1.68 ×
Highest-Value Control
Turn on activity logging and review for this access — you currently cannot tell what was taken

Step by step

  1. 1Values used
  2. 2Insider Threat Risk
  3. 3Insider Risk Band= Critical — act now
  4. 4Insider Risk Score= 9.07 / 10
  5. 5Opportunity= 6.00 / 10
  6. 6Impact= 9.00 / 10
  7. 7Motivation Multiplier= 1.68 ×
  8. 8Highest-Value Control= Turn on activity logging and review for this access — you currently cannot tell what was taken

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Insider Threat Risk calculated?

risk = (opportunity × impact ÷ 10) × motivationMultiplier, where opportunity = mean(access breadth, privilege, monitoring gap, DLP gap) and impact = data sensitivity plus a record-volume uplift. Insider risk is opportunity multiplied by impact, adjusted by motivation. Opportunity deliberately combines what the person can reach with how poorly it is observed, because unmonitored access is what turns capability into unattributable loss. Motivation uses only objective, defensible signals — employment status and observed behavioural indicators — and is capped at 3×. This is a prioritisation estimate for where to apply monitoring, not a judgement about any individual.

Why does Insider Threat Risk matter?

The single biggest insider variable is not privilege, it is whether anyone would notice: unmonitored administrative access to a customer database is a loss you discover from a news article.

What values do I need to enter?

This calculator takes 8 inputs: Systems the individual can reach, Privilege level, Sensitivity of reachable data, Monitoring of that activity, Behavioural indicators observed, Employment status, Egress and DLP controls, Records reachable. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is this a way to profile employees?

No, and it should not be used that way. It is designed to score access paths and control gaps, which is why the highest-weight factors are monitoring and DLP. Use it to decide where to instrument, and handle any individual concern through HR and legal process.

Why does serving notice raise the score?

Because the observed pattern in insider data-theft cases is bulk copying in the final weeks of employment, usually of material the person legitimately used. It is a control trigger — tighten bulk export and review access — not an accusation.

Related Calculators

Insider Threat Risk Calculator – Calculate Insider Risk Band