Work out insider threat risk score instantly with clear inputs, formula shown and shareable results.
Insider risk is driven by the product of access and data sensitivity — the potential impact — uplifted by behavioural indicators such as unusual access patterns, resignation notice or policy violations. Monitoring does not remove the access, so it can only mitigate part of the inherent risk; the residual score is what should drive access reviews and just-in-time privilege decisions.
Insider risk score
inherent = access level x sensitivity level x 4 + 5 x behavioural flags; residual = inherent x (1 - 0.6 x monitoring coverage)
Detection happens after the action. It shortens the window and supports investigation but does not prevent a privileged user from exfiltrating data they are authorised to read.
Removing standing privilege. Just-in-time access, approval workflows and separation of duties lower the access term rather than merely observing it.