Insider Risk
See the insider risk that surfaces outside your network.
Internal controls watch what happens on your systems. The earliest signs of insider risk often appear somewhere else: access advertised on a criminal forum, a recruiter's approach, a second employer nobody declared. We find those signals lawfully and investigate them under the direction of counsel.
- Urgent tasking
- First assessment within 24 hours
- Exposure assessment
- 3 weeks, point in time
- Works with
- Your counsel, security and people teams
- Team
- Insider risk lead, dark web and corporate records analysts and a red-team reviewer
- Deliverable
- Sourced findings with stated confidence and options for counsel
- Pricing
- Fixed fee per matter, or a retained program
When to call us
When the risk is a person with legitimate access.
Insider matters are the most sensitive work we do, because the subject is someone the client employs or trusts. We take them only where there is a specific concern, a lawful basis and counsel involved.
Access for sale
Credentials, remote access or internal data advertised in criminal markets by someone who appears to work inside the organization.
Recruitment approaches
Criminal groups, competitors and state-linked programs advertising for, or approaching, people with access to your systems, research or facilities.
Undisclosed affiliations
Parallel employment, outside companies, patents and funding that conflict with a role and were never declared.
Leaks and disclosures
Confidential material appearing in forums, in the press or in a competitor's hands, where the source needs to be established fairly.
Departures and data
Leavers setting up in competition, or information that appears outside the organization shortly after a resignation or a dispute.
Fraudulent insiders
Staff or contractors working under a borrowed identity, or passing their access to a third party who does the work in their name.
What you receive
Findings fair enough to act on.
An insider finding can end a career. Our reports separate what is established from what is inferred, test the innocent explanations first and state a confidence level for every judgment.
- The external signal, preserved and hashed at capture
- What it establishes on its own, and what it does not
- The innocent explanations we tested, with the evidence for and against each
- Any link to a person stated with confidence, never implied
- Options for counsel: internal review, containment, referral or no action
- Exposure that needs fixing whoever was responsible
How it runs
A specific concern, a lawful basis, a narrow scope.
We do not run general surveillance of a workforce. Each matter starts from a defined trigger and stays inside limits agreed with counsel before collection begins.
-
01 / Trigger
Day 1
We establish the specific concern, the lawful basis and who may know about the work. Matters without a credible trigger are declined.
-
02 / Scope
Days 1 to 2
With counsel, we set what may be researched, about whom and for how long, and what is out of bounds, including private accounts and protected activity.
-
03 / Investigate
Days 2 to 12
Analysts work the external signal: the listing, the persona, the filings or the leak. Every item is captured and hashed, and innocent explanations are tested first.
-
04 / Report
Days 10 to 15
After red-team review, findings go to counsel with stated confidence, the alternatives considered and the options for what happens next.
Tradecraft
What the outside world shows that your logs cannot.
Internal monitoring sees behavior on your systems. It cannot see a persona selling access, a recruiter's post or a patent filed under another employer's name. Those signals live in open sources.
- Closed-market observationForums, markets and channels where access and data are sold, watched through non-attributable infrastructure by analysts who observe and never purchase or engage.
- Listing analysisDescriptions, screenshots and samples examined for the details that identify an environment, a team or a time window, even when the listing names nobody.
- Persona resolutionSeller handles linked to other accounts through reused encryption keys, contact details, writing habits and payout addresses.
- Recruitment monitoringPublic solicitations aimed at your staff, from posts offering payment for access to approaches made through professional networking profiles.
- Affiliation researchPatent and publication records, grant acknowledgments, conference programs and company filings that reveal a second role.
- Corporate recordsNew companies, directorships and domain registrations connected to current staff or recent leavers.
- Leak forensicsDocument and screenshot artifacts that narrow where and when a leaked item was produced, assessed alongside the client's own access records.
- Blockchain tracingPayments for access followed across public ledgers to the points where legal process can identify the recipient.
Results
Matters resolved without guesswork.
Client names are withheld and identifying details changed. The methods, timelines and outcomes are reported as they happened.
Life sciences
The second employer
Patent filings, grant acknowledgments and conference programs showed a senior scientist held an undisclosed parallel post overlapping the client's core program.
Technology manufacturing
Attributing a product roadmap leak in nine days
A confidential roadmap surfaced on an enthusiast forum. Screenshot artifacts, posting habits and the client's own access records narrowed 340 possible sources to one.
Questions
Insider risk FAQ
Do you monitor employees?
No. We do not run general monitoring of a workforce and we do not look at employees' private accounts. Our work starts from a specific external signal or a defined concern, and its scope is agreed with counsel before any research begins.
What counts as a legitimate trigger?
A concrete indication of harm: access or data offered for sale, a leak, a credible report through an internal channel, or a material conflict the organization is entitled to know about. Suspicion based on a person's background, nationality or opinions is not a trigger, and we decline requests that rest on it.
Will you identify a whistleblower?
No. We do not identify people who raised concerns through protected reporting channels or reported to authorities. Our standards committee declines those requests without exception.
How do your findings fit with our internal logs?
They complement each other. External evidence can show that access is being sold, and by which persona. Your own records can show whose credentials were used. We tell counsel which internal checks would confirm or exclude each explanation, and we never ask for more internal data than the question needs.
What if the evidence clears the person?
Then the report says so, as plainly as it would say the opposite. In roughly a third of the insider matters we close, the evidence points to an external cause, most often stolen credentials.
Can this be done under legal privilege?
Yes, and it usually should be. Most insider matters are commissioned through outside counsel, who direct the work and receive the report.
Start an engagement
Bring us the question nobody else could answer.
Tell us what you need to know and why. A senior investigator will scope it with you, tell you candidly what open sources can and cannot establish, and propose a plan with a fixed fee and a firm timeline.