Insider Threat Playbook
Data exfiltration by a current or former employee — detection signals, the legal constraints that change the investigation process, preserving evidence for HR and legal proceedings, and how to terminate access without tipping off the subject.
A DLP alert fires: an employee in the engineering department accessed 2,340 proprietary design files in a single session and emailed a ZIP archive containing 500MB of source code to a personal Gmail address. It's 4 PM on a Thursday. The employee is still in the office. HR tells you the employee has a performance improvement plan and a termination meeting scheduled for Monday. The technical response — disable the account, collect the evidence — is straightforward. Everything else is not: Can you search the employee's laptop? Can you read their personal email on the corporate device? When do you notify the employee? These questions require legal input before you take any action.
Legal Before Technical
Insider threat investigations have different legal constraints than external breach investigations. Employment law, privacy law (especially in EU under GDPR), and evidence handling requirements for HR proceedings all affect what the security team can and cannot do. In some jurisdictions, monitoring an employee's activity beyond what they were notified of at hire (the acceptable use policy) requires additional notice or is prohibited. A technical investigation that proceeds without legal guidance can: result in evidence being inadmissible in court, expose the company to wrongful termination liability, violate EU data protection laws, or compromise a criminal referral. Get legal sign-off on the investigation plan before opening a single log file.
Insider Threat Detection Signals
| Signal | What it may indicate | Source |
|---|---|---|
| Large volume of file access in a short window | Bulk data staging for exfiltration | DLP, file server access logs, SIEM |
| Mass printing or screenshot activity | Analog exfiltration — bypasses DLP | Print server logs, DLP screen capture policy |
| Email with attachment to personal/external address | Direct exfiltration via email | DLP, email gateway logs, CASB |
| USB insertion + large file copy to removable media | Physical exfiltration | DLP, EDR USB device events, Sysmon file create on removable drive |
| Cloud storage upload (Dropbox/OneDrive personal/Google Drive) | Cloud exfiltration — may bypass network DLP | CASB, proxy logs, DNS query for personal cloud storage domains |
| Access to data outside normal job scope | Curiosity, staged theft, or reconnaissance for later exfiltration | SIEM UEBA, file server access logs |
| After-hours access to sensitive systems | Conducting exfiltration outside business hours to avoid observation | Badge access correlation, VPN/authentication logs, SIEM time-of-day analysis |
Evidence Collection for HR/Legal Proceedings
Evidence in insider threat cases is often used in employment proceedings, civil litigation, or criminal referrals. The chain of custody requirements are even stricter than for external incident response.
# Evidence collection for insider threat — run BEFORE any account action
# Run from a separate, non-suspect workstation with appropriate authorization
$suspectUser = "jdoe"
$outputPath = "\\evidence-server\cases\INSIDER-2026-045\$suspectUser"
New-Item -ItemType Directory -Path $outputPath -Force | Out-Null
# 1. Export DLP events for the suspect user (last 90 days)
# (Depends on DLP platform — this is a generic placeholder for the export step)
Write-Host "Export DLP alert history for $suspectUser from DLP console → $outputPath\dlp_events.csv"
# 2. Export email sent/received by the account (for Exchange Online)
# New-ComplianceSearch in Security & Compliance Center is the proper tool
# This requires E-Discovery permissions — not standard security analyst permissions
Write-Host "Create content search in M365 Compliance Center for $suspectUser — export results to $outputPath"
# 3. Capture current file system state of suspect's home directory and desktop
# (Legal must confirm this is authorized before you run this)
$userProfile = "\\fileserver\users\$suspectUser"
Get-ChildItem $userProfile -Recurse | Select-Object FullName, LastWriteTime, Length |
Export-Csv "$outputPath\file_listing_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
# 4. Export authentication/access logs for the user from SIEM
Write-Host "Query SIEM for authentication events by $suspectUser → export to $outputPath\auth_events.csv"
# 5. Hash all collected evidence files immediately after collection
Get-ChildItem $outputPath | ForEach-Object {
$hash = Get-FileHash $_.FullName -Algorithm SHA256
"$($hash.Hash) $($_.Name)"
} | Out-File "$outputPath\SHA256_hashes.txt"
Write-Host "Evidence collection complete. SHA256 hashes in $outputPath\SHA256_hashes.txt"Silent Monitoring vs Immediate Action
The decision to monitor silently (building more evidence) versus acting immediately (stopping ongoing harm) must be made with legal and HR, not by the security team alone.
Insider Threat Response Decision Tree
═══════════════════════════════════════════════════════════════════
Alert fired → Confirm it's not a false positive
│
▼
Is exfiltration ongoing right now?
│
├── YES (active upload/email/copy happening):
│ → Balance: stopping it now vs. more evidence
│ → If high-value data at risk: block now, notify legal
│ → If investigation value > continued exposure: legal call
│
└── NO (past exfiltration detected):
→ Evidence collection FIRST (before account action)
→ Loop in HR + Legal + CISO
→ Design the termination process: Monday termination meeting
includes account access termination at the moment of meeting
→ Silent monitoring only if: legal authorizes it AND
ongoing access creates material risk of further harm
Account disable timing:
→ For departing employee with known termination date:
Disable access simultaneously with the termination notification
(not before — wrongful termination exposure)
→ For immediate threat to business-critical data:
Legal may authorize immediate disable as a "precautionary measure"
with documentation of the business justification
Q & A
Q: You want to image the suspect's laptop for forensic analysis. They haven't been notified of the investigation yet. Is this legal?
This is a jurisdiction-specific legal question that your legal counsel must answer. In the US, employer forensic review of corporate-owned devices is generally permitted if: the acceptable use policy explicitly states that company devices are subject to monitoring and review (most corporate AUPs include this language), and the investigation is of corporate data on a corporate device. However: if the employee used the device for personal activity that the company can now see (browser history, personal files), there are state-level privacy laws (California, Colorado) that may limit what you can review. For EU employees, GDPR applies to personal data processing even on corporate devices. Get a legal opinion specifically for your jurisdiction before imaging. Document the authorization in writing before the image is taken.
Q: The suspect is leaving for a competitor. They've already resigned. Do the insider threat investigation requirements change?
The technical investigation is the same. The legal requirements change slightly: (1) A resignation doesn't create authority to conduct a broader investigation that wasn't already authorized — you need the same legal sign-off. (2) For departing employees going to a competitor, the trade secret angle becomes relevant — if they took proprietary information to a competitor, this is a trade secret misappropriation case (potentially criminal under DTSA in the US), not just an employment/HR matter. Loop in outside counsel with trade secret expertise, not just the employment attorney. (3) Disable access at the moment of departure, not before — early access termination before a formal notification creates legal exposure. Coordinate the access termination with the last day of employment and the offboarding process.