Appendix D. Insider Threat Database Structure

Since 2001, we have been collecting incidents of malicious insider activity that occurred in U.S. organizations. In each of those incidents, the insider was found guilty in a U.S. court of law. To date, we have collected more than 700 cases of insider IT sabotage, fraud, theft of intellectual property, and national security espionage. This data provides the foundation for all of our insider threat research, work in our lab, assessments, workshops, and exercises.

We record actual insider incidents, providing a behavioral and technical framework for characterizing insider activity and analyzing incidents in a meaningful way that can be used to prevent, detect, and respond to insider threats. The recording of the details of an insider incident is commonly referred to as “coding.” This appendix describes the structure of the insider threat database, as well as our data collection and coding process. This appendix will most likely be useful to other researchers, as it addresses questions we have received from the research community over the years.