A Serious Insider Threat
In one adopting organisation, an insider threat was detected through isolating a series of uncharacteristic behaviours.
An admin user logged into a critical server using a functional account which raised the alarm. Then using IP attribution to identify the true identity of the inside threat, the company was able to cancel the individual’s contract and instigate legal proceedings against the offender.