Insider threats are rarely a single event. They are patterns of behaviour that emerge over time. An employee who connects a personal USB drive, downloads sensitive archives, and browses file hosting sites in the same day is exhibiting a pattern that no single alert would catch. The Insider Threat Intelligence Engine is designed to detect exactly these multi-signal patterns.

The engine ingests telemetry from 10 agent modules and evaluates each user’s daily activity against 17 distinct threat signals grouped into four vectors: exfiltration, unauthorised access, evasion, and staging/policy violations. Each signal is weighted based on its risk significance, and scores are calculated per user per day.

Additional score modifiers account for after-hours activity and multi-vector diversity. When a user triggers signals across multiple threat vectors in a single day, the engine recognises this as a higher-risk pattern. All scores include full evidence trails so investigators can drill down from the composite score to the individual events that drove it.