Insider Risks: A Diagnostic Tool to Detect and Preempt Non-Violent and Violent Insiders During Pre-Incident Phases

Introduction

Insider threat incidents, whether non-violent or violent, pose dangerous risks to a country’s national security and private sector organizations. Termed Insider Threat Actors (ITAs), they are driven by a continuum of insider threat factors within organizations, ranging from ideological extremism, desire for illicit financial gain, or notoriety, treason, and negligence. These insider threats originate from internal employees or third-party contractors, with legitimate and authorized physical and information technology (IT) access, making their breaches difficult to detect and prevent.

The consequences of insider threat IT breach or violent attack can be severe. In the case of non-violent insider incidents, the consequences can be financial costs, legal penalties, and reputational damage. In the case of violent incidents, the impacts can be loss of human life and/or injuries, possibly resulting in expensive lawsuits, and a perception that the targeted organization cannot safeguard its employees. In both types of insider attacks, the impacted organizations will suffer from financial losses, regulatory compliance fines, and a reputation that they cannot safeguard the security of their employees, customers, and products.

To identify the early warning signs from disgruntled current or former employees who might conduct IT-type breaches or violent attacks, it is crucial to understand the pathways that turn employees into insider threats. Layered mitigation security programs and measures are essential to protect sensitive proprietary data, and, in the case of violent insiders, to safeguard employees from violent attacks.

The currently highly polarized political environment, which is also accompanied by the loss of jobs due to economic downturns and dislocations makes the escalation of insider threats of all types more likely. This is a significant national security risk that demands understanding of its evolving trendlines and how to mitigate them.

Insider Threat Classified by Motivations

The non-violent and violent ITAs are characterized by at least seven types of perpetrators.

Type I – Extremist Ideology – These employees express ideological hatred and intolerance towards society and strong support for militantly extremist groups/movements, whether domestic or foreign, that promote violence against the society, with their organization becoming the primary target for their attack. The insider incident could be unauthorized exfiltration of sensitive proprietary material that will be leaked to the media to damage national security, or violent attack against the organization’s employees. [Non-Violent or Violent Insiders]

Examples:

• May 2010: At the time known as Bradley Manning, while serving as an intelligence analyst with a U.S. Army unit in Iraq, he leaked thousands of documents from classified databases to Wikileaks. Arrested in May 2010, he was reportedly motivated by his opposition to the U.S. Governments’ wars in Iraq and Afghanistan. [Non-Violent Insider]
• May 2013: While working for two months as a contractor at Booz Allen, Edward Snowden exploited his access to the National Security Agency’s classified worldwide surveillance programs to leak a massive trove of its documents to Glenn Greenwald, a journalist working at The Guardian newspaper. Snowden evaded arrest by making his way to Russia where he was granted asylum. [Non-Violent Insider]
• December 2, 2015: Syed Rizwan Farook and Tashfeen Malik, a married couple, who were radicalized into jihadism, targeted the husband’s training event and holiday Christmas party of about 80 health department employees at a banquet room in San Bernardino, CA, killing 14 people and wounding 22 others. The couple were killed during their attempted escape from the scene. [Violent Insiders]

Type II – Revenge — As non-ideological-violent insiders, these employees feel they are unfairly treated by their organizations. For instance, they may believe that their professional advancement has been prevented. This grievance leads to willingness to engage in workplace violence type III – Worker (or ex-worker)-on-Worker retribution to inflict as much loss of life as possible. [Violent Insiders]

Examples:

• September 27, 2012: Andrew John Engeldinger, 36, when informed, as he had anticipated, that he was about to be fired from his job at the Accent Signage Systems, in Minneapolis, MN, he walked to his car to retrieve his Glock 19 9mm semi-automatic handgun. Returning to the company’s building, he proceeded to conduct a mass shooting spree, killing 6 and wounding 2. He then killed himself. A loner, he was characterized by his family as suffering from mental illness, for which he resisted treatment, eventually becoming estranged from them.
• September 16, 2013: Aaron Alexis, 34, worked as a subcontractor with a security clearance at the Naval Sea Systems Command (NAVSEA), inside the Washington Navy Yard, in southeast Washington, DC. He used his access to fatally shoot 12 NAVSEA employees and injure 3 others. The shooting spree ended when he was killed by a responding Washington Metropolitan Police Department SWAT Team leader. Reportedly, Alexis suffered from mental illness, including schizophrenia, which led him to target his victims.

Type III – Notoriety – These employees seek fame as public heroes for a political cause by leaking sensitive proprietary information, or they may be ‘bad leavers’ who publicly oppose their organizations’ policies to embarrass the organization (as well as their country). [Non-Violent Insiders]

Examples:

• October 2013: Jofi Joseph, 40, at the time a non-proliferation official at the National Security Council, using handle @natsecwonk, tweeted embarrassing details about the Obama Administration, although none of them included classified information. He was subsequently fired. [Non-Violent Insider]
• September 29, 2023: Charles Littlejohn, 38, who worked as a contractor at the IRS on behalf of Booz Allen, was charged with the unauthorized disclosure of tax filing information by former President Donald Trump and wealthy individuals, which led to their publication by The New York Times and ProPublica in 2020 and 2021. In October 2023, after pleading guilty to the unauthorized disclosure of the income tax returns, in January 2024 he was sentenced to five years in prison.
• December 2022: Jack Teixeira, 21, a member of the Massachusetts Air National Guard (ANG), who worked since 2022 as an IT specialist in the 102nd Intelligence Wing, based at Otis Air Force Base, began posting Top Secret Pentagon documents on his Discord channel. He reportedly posted them to impress his fellow Discord group’s members. In November, 2024, he was sentenced to 15 years in prison. Fifteen members of the Massachusetts ANG were disciplined for “lack of supervision” and a “culture of complacency.” [Non-Violent Insider]

Type IV – Espionage (Industrial Competitor/Foreign Nation) — These employees are recruited (or self-recruited) for financial or ideological reasons to extract classified or proprietary national security- or corporate-related information to hand over to business rivals or foreign states. Their motivation is commonly described by the acronym MICE (money, ideology, compromise, and ego). [Non-Violent Insider]

Examples:

• February 1994: Beginning in April 1985, Aldrich Ames, a top CIA intelligence operative, began spying on behalf of the Soviet Union. Among his treasonous activities, for which he received several million dollars, he provided his Soviet handlers the identities of more than ten top-level CIA and FBI sources who were reporting on Soviet operations. Ames was arrested on February 22, 1994, and, following his conviction, was sentenced to life imprisonment. [Non-Violent Insider]
• January 2025: John Harold Rogers, 64, of Vienna, VA, a PhD in Economics, a former senior adviser in the Federal Reserve’s international finance division, was arrested for revealing restricted central-bank financial information about interest rate decisions before they became public to Chinese intelligence operatives. In July 2026, he was sentenced to 38 months in federal prison for lying to investigators about sharing the restricted information, although not for conspiracy to commit economic espionage. [Non-Violent Insiders]

Type V – Fraud — These self-recruited employees exfiltrate an organization’s proprietary data of monetary value for illicit financial gain. [Non-Violent Insider]

Example:

• November 1, 2022: Dhirendra Prasad, 52, of Mountain House, CA, a former buyer for Apple’s Global Service Supply Chain, was convicted of abusing his autonomous purchasing power to siphon funds through several coordinated schemes from 2011 to 2018. He was sentenced to three years in federal prison and ordered to pay over $19 million in restitution ($17.4 million to Apple and $1.9 million to the IRS). His two co-conspirators were convicted as well.

Type VI – Negligence — These employees, whether working in an organization’s office, as remote employees working at home, or as third-party contractors, fail to comply with an organization’s security policies and practices by engaging in unintentional misuse of IT systems that opens a door to cyber or physical breaches. These are not generally considered direct breaches, nor are the employees motivated by malice. [Non-Violent Insider]

Example:

• November 2020: An unauthorized third party socially engineered the phone of a customer support employee at the Robinhood trading platform, which enabled it to obtain access to some of its customer support systems’ personal information.

Type VII – Compromised Accounts – These breaches are not committed by actual employees. External cyber attackers impersonate employees’ credentials via a compromised user account. This represents a new type of hybrid IT in which external attackers utilize advanced technological tactics, such as deploying artificial intelligence (AI), to impersonate human actors. [Non-Violent Insiders]

Example:

• April 2025: The Scattered Spider hacking group launched a social-engineering attack on Tata Consultancy Services, the British Marks & Spencer’s third-party service desk. It impersonated a Marks & Spencer employee and convinced the support staff to reset a password, thereby gaining access to to the company’s IT systems. Over time, the hackers deployed a ransomware attack on Marks & Spencer’s VMware servers (a virtualization-software server suite). The attack affected more than 1,000 stores, suspending online sales for several days, and resulting in the theft of customer data.

Note that among the seven types of ITAs, non-violent ITAs carried out six types of insider threats, while Types I & II also involved violent insider perpetrators.

Insider Threat Pathway Diagnostic Tool

As outlined in Table 1, eight phases characterize the pathway for susceptible individuals to progress into becoming either non-violent or violent ITAs. The phases are arrayed along three levels of concern, which range from Level 1: negligible, low, and moderate (e.g., Phases I-III), to Level 2: elevated (Phase IV), and Level 3: high (Phases V-VIII).

The first level characterizes the mindsets and behaviors of individuals who experience traumatic events. The overwhelming majority of those who experience traumatic events will be psychologically ‘normal’ and will possess the psychological and social mechanisms to cope with their traumatic events in a constructive way. While traumatized, they will likely remain in Phase III. They might exhibit concerning behaviors, but no actual threat will be present.

It is crucial to understand the nature of persistent grievances and fixations of ITAs as they represent the key to preventing insider threat attacks. No single suspicious mindset or behavior determines if an individual is on a path to committing an insider breach, but correlating multiple suspicious behaviors may be cause for concern and follow-up. If they are not pre-empted, a minority of susceptible individuals who exhibit psychological disorders (Phase I) will respond to such traumatic events (Phase II) in a non-constructive way, facilitating their transition into the second level’s Phase IV. Phase IV represents the threshold in which the risk mitigation factors are low and the risk enhancing factors are high. The third level, Phases V-VIII, represents the susceptible individuals’ preparation to carry out an attack, whether non-violent or violent. Cumulatively, the eight phases arrayed along the three levels of concern represent intervention points for those associated with the susceptible individuals to pre-empt them using appropriate mitigation measures. Depending on the circumstances, mitigation could include referral to HR Departments, mental health counseling, or arrest by law enforcement.

Post-Attack Aftermath - Escape from Attack Location

Reluctance to Report Potential Insider Threats

Despite the likelihood that a workplace colleague, friend, or family member might be aware that a susceptible individual might become an ITA, whether non-violent or violent employees, there might be a reluctance to report such concerning mindsets and behaviors. This is due to at least five factors:

• Fear of Retaliation: Employees are concerned about being labelled as a ‘snitch’ who turn in their colleague, especially if their own identity is revealed. They may also fear possible firing or demotion if their suspicions are not validated.

• The Bystander Effect: Employees assume that someone else will notice the ITA’s suspicious behavior and report it. They convince themselves that it is not their job to policy fellow colleagues.

• Ambiguity and Doubt: It is difficult to tell if a co-worker’s suspicious mindset and behavior is a genuine security risk, so the employee will be given the benefit of the doubt.

• Social Loyalty: Friendship with the susceptible employee or an organizational culture of peer pressure make reporting the co-worker appear like a betrayal of trust.

• Distrust in Organization’s Leadership: Employees who notice potential ITA activities lack confidence that the organization’s leadership will follow up with an appropriate investigation or protect the threat reporter’s anonymity.

Insider Threat Mitigation Program (ITMP)

To overcome possible reluctance of fellow employees to report suspicious activities by potential ITAs, it is crucial to establish an insider threat mitigation program (ITMP). Note that this ITMP program aims at mitigating the non-violent ITA, as opposed to a violent ITA, which requires a different set of preventative measures.

Preventing and mitigating ITA attacks involves establishing a four-pronged multidisciplinary approach:

1. Detection – Administrators should identify an organization’s key assets that need to be safeguarded, establish acceptable baseline IT-usage activities, and deploy IT surveillance tools. These will alert administrators to emails with unusually large attachments; tag documents that should not be permitted to leave the network; track or prevent printing, copying, or downloading of significant proprietary materials, such as personally identifiable information (PII) or documents that contain certain significant words, such as new product codenames; track proprietary documents copied to removable media; and prevent or detect emails to business competitors, whether domestic or foreign accounts.
2. Denial: Establish effective security practices to monitor user behavior (e.g., prevent unauthorized users from accessing proprietary materials); and implement staff security practices, such as two-factor authentication.
3. Deterrence: Provide training to employees in understanding suspicious ITA activities and enforce security policies, such as reporting IT breaching incidents, and ensuring that terminated employees do not violate security protocols by downloading proprietary materials prior to their exit.
4. Mitigation: Implement security intervention measures to lower overall ITA risk to what are considered as acceptably low levels.

Future Trends

The rapid and ungoverned rise of generative AI has catapulted organizations into a new era of productivity and risk. IT tools once limited to developers or data scientists are now in the hands of every employee, creating new opportunities for innovation and for unintentional and intentional data exposure. This has created new pathways for data leakage by employees.

With artificial intelligence (AI) altering the ITA landscape, advanced technological capabilities that once required highly sophisticated organizations are now widely accessible, exponentially lowering the barrier to high-impact ITA attacks. Human ITAs with privileged access are now acting as insiders, with attacks shifting from “breaking in” to “logging in,” thereby leveraging their legitimate access and trusted identities to breach an organization’s IT systems.

Conclusion

In managing an insider threat prevention program, the operating methodology should be to identify potential internal and external threats and investigate the suspicious mindsets, behaviors, and technical indicators of likely attacks and compromise, whether non-violent or violent. Mitigating the insider risk requires an understanding of human behavior, psychological-social factors and trends, and identifying what might be anomalous and abnormal. Insider threat prevention is a function that requires organizational collaboration and information sharing with human resources, legal, finance, technology, and cyber security teams. Early warning indicators of malicious intent are crucial to identify, since actual exfiltration of proprietary material or violent attacks represent the final steps in the insider threat trajectory. Finally, it is crucial for organizations to differentiate between whistleblowers, whose complaints are legally legitimate and must be tolerated and encouraged, and insider threats, which, other than cases of negligence, are illegal.