Insider Threat Program

Insider incidents are the costliest category of security event, averaging over $15 million per incident, and they are growing nearly 50% year over year. Detecting insiders requires behavioural analytics, not just rule-based alerting — and doing it without violating employee privacy or labour law requires careful program design. Mjolnir helps Canadian organizations build insider threat programs that work and that hold up to legal and ethical scrutiny.

Program Design & Governance

Insider threat is as much a governance and HR problem as it is a technical one.

• Insider threat program charter and stakeholder alignment (security, HR, legal, privacy)
• Privacy impact assessment aligned to PIPEDA and provincial privacy acts
• Acceptable use, monitoring, and notice policy development
• Investigation protocols with legal review and chain of custody
• Workforce communication strategy that builds trust rather than paranoia

Behavioural Detection & UEBA

Effective insider detection requires behavioural baselines, not static rules.

• User and entity behaviour analytics (UEBA) deployment and tuning
• Anomalous data access, exfiltration, and privilege escalation detection
• High-risk role monitoring (departing employees, privileged users, contractors)
• Integration with identity, DLP, and endpoint telemetry
• Contextual scoring that minimizes false positives

Investigation & Response

When an insider incident is suspected, the response process must protect both the organization and the employee.

• Discreet preliminary triage and validation procedures
• Coordinated response with HR, legal, and management
• Forensic evidence collection that preserves chain of custody
• Termination and offboarding security procedures for high-risk departures
• Post-incident lessons learned and program improvement