Malicious Insiders: Individuals who intentionally use their access to harm the organization, often for financial gain, revenge, or competitive advantage.

Negligent Users: Individuals who accidentally cause security breaches through poor habits, such as clicking phishing links, misplacing devices, or using unauthorized cloud storage.

Dedicated Activity Dashboards: Use dedicated monitoring Dashboards such as Applications & Websites, Emails, Instant Messages, etc. to check for specific threat vectors. These dashboards provide a granular look at how users interact with external platforms and internal tools to identify technical anomalies. For example, the Applications & Websites dashboard allows security teams to map "normal" tool usage for specific roles, making it easy to spot deviations such as an employee suddenly using system utilities (e.g., “icacls.exe”) or unauthorized "Shadow IT" cloud storage for potential data exfiltration. The Emails dashboard helps you monitor inbound and outbound traffic, flagging high-risk indicators like mass forwarding to external domains or the inclusion of sensitive attachments. By correlating these metrics, organizations can detect "low and slow" patterns, such as increased after-hours activity or unusual data movement that signal a shift from productive work to a potential insider threat.

Advanced Filtering: Utilize the built-in filters to find high-risk or targeted activities quickly. For example, in the File Events dashboard, you can filter for "Upload" or "Remove" event types to pinpoint potential data exfiltration. This level of detail ensures that no suspicious action goes unnoticed.

Employee Details: Access the Employee Details screen to review a consolidated view of an individual's behavior. This includes their application and web activity, keystrokes, file transfers, and other essential data points in one centralized location.

Access: Navigate to Dashboards > Insider Threat Detection from the main menu.

Top Offenders at a Glance: The File Uploads, Outgoing Email Attachments, Outgoing IM Attachments and Printing widgets rank the employees with the most activity in each channel, so you can immediately see who is moving the most data out of the organization.

Detailed Event Lists: The Outgoing Emails with Attachments, File Uploads, Outgoing Instant Messages with Attachments, High Volume Printing and Keystrokes with Sensitive Words tables list the individual events behind those numbers, including the attachment name, destination, page count or the typed text and the app or website where it was entered.

Investigate in Context: Use the date range and Filters to focus on specific employees, departments or time periods, and click the video icon next to an event to open the Session Player at the exact moment it occurred. You can also click Customize dashboard to add or remove widgets, or Export the data for further analysis.

Access: Navigate to Dashboards > AI Usage Control from the main menu. The dashboard is organized into tabs, each focused on a different aspect of AI usage.

AI Application Usage: The AI Application Usage tab shows which AI applications and websites are being used, by whom and how often. Widgets such as Usage Timeline, AI Usage by Department, AI Usage by Employee, Top Apps/Domains and Top AI Categories help you spot unapproved tools and unusual spikes in usage.

AI Chats: The AI Chats tab lets you review the messages employees exchange with AI tools, including the direction, AI tool type, message content and any attachments. Use the Outgoing Messages Volume and AI Chats by Employee widgets to identify who is sharing the most information with AI tools.

AI Risk: The AI Risk tab brings together alerts from your AI-related rules, such as blocking file uploads to AI chats or detecting API keys pasted into AI tools. Widgets like Alerts Heatmap, Top Violating Employees, Top Violating Rules and Shadow AI Alert Count help you prioritize the highest-risk users and behaviors.

Agentic AI: The Agentic AI tab tracks the activity of AI agents running on employee computers, including agentic alerts and the local files they access, so you can detect automated data access that may otherwise go unnoticed.

Behavior Policies & Rules: The intuitive, visual Rules Editor, accessible from the Behavior Policies screen, allows you to detect insider threats. You can build complex, multi-layered triggers by utilizing diverse detection criteria, conditions, and advanced logic. These "smart rules" can be tailored to monitor for critical indicators for insider activities, ranging from simpler behaviors, such as a user trying to use an unauthorized app, taking a screenshot, or uploading sensitive data to identifying technical maneuvers like attempts to modify GPO policies to enact defense evasion. By combining specific criteria like user groups, high-risk schedules, and detailed content definitions, you can identify "low and slow" attacks that typically bypass standard security filters.

Automated Intervention: Once a threat is detected, Rule Actions provide the mechanism for immediate, automated prevention to stop a threat before it occurs. Depending on the severity of the incident, the Teramind Agent can deploy a range of defensive measures, from a deterrent Warn pop-up that alerts a user to a policy violation, to a Block action that instantly terminates a prohibited file transfer or email. For high-risk scenarios, such as suspected account takeover or active data exfiltration, the Lock User action can completely sever a user’s session, preventing further unauthorized access to the network. Furthermore, the system can execute the Command action to execute commands or scripts on the endpoint, such as disabling a network interface or closing a specific application. This automated response layer ensures that mitigation happens in milliseconds - neutralizing insider threats at the point of origin.

Behavior Alerts: The Basic tab of the Behavior Alerts dashboard provides a chronological record of every policy and rule violated across the organization. This centralized report enables security teams to move beyond isolated incidents and identify evolving patterns of suspicious behavior over time, such as repetitive unauthorized access, exfiltration attempts, or unusual logins. By detailing the specific triggers, the dashboard provides visibility into the exact rule criteria and conditions to help you understand the context. Furthermore, built-in heatmaps and charts allow administrators to cross-reference these technical logs with temporal data, making it easier to distinguish between routine operational tasks and high-risk anomalies that require immediate investigation.

Rule-Based Risk Assignment: You assign risk severity to a rule from its Actions > Advanced tab. This will allow you to track the risk records on the Risk tab.

Risk Dashboard: The Risk tab of the Behavior Alerts dashboard serves as a centralized hub for detecting insider threats by correlating user activities with established behavioral baselines. By analyzing the top violating employees and top risky rules, security teams can pinpoint individuals who frequently bypass protocols or engage in high-risk actions. A risk heatmap view allows administrators to identify temporal patterns, such as spikes in suspicious activity during off-hours while the top risky departments view helps prioritize security training and resource allocation for high-exposure business units like Sales or Marketing. This combination of real-time monitoring and historical trend analysis enables organizations to transition from reactive incident response to proactive risk mitigation.

Forensic Review: Use the Session Player as a powerful forensic tool to gain a visual, time-stamped record of every user action, whether you are reviewing historical data or monitoring a live session. You can open any activity on the dashboards in the Session Player to see a step-by-step playback of the incident. When you suspect an insider threat, you can use the player to perform historical playback complete with incident timeline and tags, allowing you to reconstruct the exact sequence of events, such as unauthorized access to sensitive files or changes to system configurations that occurred leading up to a security incident. These recordings provide you with a tamper-proof "black box" of irrefutable forensic evidence, enabling you to differentiate between accidental policy violations and intentional malicious behavior with absolute clarity.

Remote Control: The Remote Control feature built-in the Session Player enables you to immediately contain a propagating threat by intervening directly during a live session. If you identify a breach in progress, you can instantly launch a remote desktop session to take full control of the endpoint, or, freeze user inputs. This capability essentially allows you to "remove the user from the equation," giving you the power to stop a data exfiltration attempt or close unauthorized applications in real-time before any damage is done. By utilizing this hands-on response layer, you transform the platform from a monitoring tool into an active incident mitigation system.

OCR: The Optical Character Recognition (OCR) feature significantly accelerates your forensic discovery by indexing every piece of text that appears on a user's screen, regardless of the application or document type. You can use the OCR dashboard to perform high-speed, global searches for sensitive keywords, such as client names, credit card numbers, or proprietary project titles across screen recordings to uncover hidden patterns of data mishandling. Alternatively, you can use OCR rules to automate the process. OCR is particularly effective for detecting "visual" threats, such as text within images, encrypted messages, or non-searchable PDF files that traditional data loss prevention tools would overlook. Within your search results, you can click a camera icon to see a screenshot marking the areas where the text was identified or jump directly to the exact moment in a video recording, providing you with immediate visual context for the violation.

Use Case Specific Views: The Productivity dashboard provides use case specific views, each on its own tab, so you can focus on the behavior that matters most for your investigation: Overview (overall trends and department comparisons), Time Worked, Productivity Analysis, Remote Workforce Activity, Time Theft Identification/Prevention (work-related vs. non-work-related time, idle time and logged work time), Office-by-Office Performance Comparisons and Hybrid Workforce Monitoring (in-office vs. remote engagement and app/site usage).

Behavioral Indicators: You can establish a unique behavioral baseline for every user by monitoring average productivity trends on the Overview tab. A sudden, sustained drop in productive time or a spike in non-work-related activity on the Time Theft Identification/Prevention tab can signal a "quiet quitter" or a disgruntled employee who may be planning to exfiltrate data.

Temporal Anomalies: You can use the Productivity dashboard to pinpoint users working at unusual hours or those whose activity levels deviate significantly from their established norms. Because the time-based charts track exactly when employees are active or idle, you can easily spot significant late-night or weekend sessions. These anomalies may indicate that an insider is attempting to perform unauthorized tasks, such as bulk data exfiltration, while they believe they are unmonitored.

Location-Based Discrepancies: You can use the Office-by-Office Performance Comparisons and Hybrid Workforce Monitoring tabs to identify outliers in performance across different offices or remote settings. A significant drop in productivity at a specific remote location compared to the company baseline may indicate an employee is working from an unsecure environment or is distracted by "off-system" activities that could lead to negligence or data mishandling. Coupling that with the Geolocation Dashboard helps you identify "impossible travel" scenarios and other remote work risks.

17 Ways To Prevent Insider Threats: Steps, Tips & Tools (2026): A comprehensive guide on implementing endpoint monitoring, UEBA, and data loss prevention software to secure the modern workforce.

What Are Insider Threats & How to Detect Them: Defines common types of insiders (malicious, negligent, and opportunistic) and why they are difficult to combat.

Insider Threat Indicators: 10 Warning Signs to Look For: Covers the behavioral and technical warning signs of insider threats, such as unusual data movement, access anomalies, and security tampering.

How To Leverage Insider Threat Analytics For Decisive Action: Explains how monitoring endpoint, file, email, messaging, and network activity helps you detect insider risks early and respond quickly while protecting employee privacy.

How to Build an Effective Insider Threat Program in 8 Steps: A step-by-step guide to building an insider threat program, from assessing risks and securing leadership support to training staff and choosing monitoring tools.

How To Create an Insider Threat Incident Response Plan: Explains how to define roles, escalation procedures, investigation, and recovery steps so your team can respond quickly when an insider incident occurs.

Data Exfiltration Forensics: How to Trace Stolen Data: Shows how investigators reconstruct exfiltration incidents using logs, file metadata, endpoint activity, and network evidence.

How to Detect and Prevent AI Insider Threats: Explores how generative AI tools create new insider risks, such as employees pasting sensitive data into public chatbots, and how to address them with governance and monitoring.