From Assessment to Action: Building a Proactive Insider Threat Program
In the first two blogs of this series, we looked at how insider threat programs compare across organizations and what separates more mature programs from the rest. The final step is putting those principles into practice.
For many organizations, a Program Maturity Assessment (PMA) can be the starting point—not simply for identifying weaknesses in an insider risk program, but for uncovering where the organization may already be exposed to strategic threats.
Strider worked with one company in early 2026 whose security program was considered average for its tenure. Following a Strider PMA, and as part of a broader effort to make its program more proactive, the organization identified a business unit developing technology expected to provide a significant strategic market advantage over the next decade.
That recognition shifted that company’s thinking from “How mature is our insider threat program?” to “What do we have that an adversary may want—and who has access to it?”
Identifying Who Was at Risk
Using Strider Insights, the organization’s security team identified approximately 400 engineers who either had access to the relevant research or possessed expertise sought by the People’s Republic of China (PRC). That finding gave the company a much more precise understanding of its exposure.
Rather than treating the entire workforce as equally at risk, the organization could focus attention on a specific group of employees whose expertise and access made them more likely targets for foreign actors.
Strider advisors then provided awareness briefings to those engineers, as well as company executives. The briefings explained the strategic interest in their work and highlighted tactics, techniques, and procedures commonly used to approach individuals with valuable technical expertise.
The goal was not to create suspicion; rather, the goal was to give employees enough context to recognize interactions they might otherwise have viewed as routine professional engagement.
What Employees Recognized Once They Understood the Threat
That awareness produced immediate results.
During the briefings, several employees began sharing experiences that closely matched the tactics being discussed. Some had been contacted while traveling in China. Others described approaches that occurred while attending professional conferences in the United States.
The company also identified multiple cases in which employees had been invited to PRC-funded events intended to develop relationships that could later be leveraged to gain access to information. For employees who had attended those events, the security team conducted additional risk inquiries using Strider People Search. Those inquiries found that some individuals had been approached by known PRC talent recruiters.
Leaving the briefings, employees were better equipped to understand why certain interactions mattered and security teams had the context and intelligence necessary to evaluate those interactions more effectively.
That is a critical distinction between a reactive insider threat program and a proactive one.
A reactive program waits for suspicious behavior to surface. A proactive program understands what may be targeted, who may be approached, and what those approaches are likely to look like.
Turning Intelligence Into Operational Changes
The organization did not stop with awareness. Strider’s PMA findings prompted changes across several parts of the business.
Travel Policies
The company’s HR team updated travel policies to reduce the potential exposure of sensitive information during overseas travel. Employees were no longer permitted to take company-issued mobile phones or laptops to certain overseas conferences.
This was not simply a cybersecurity response. It required coordination between security and HR—precisely the type of cross-functional integration that distinguishes more mature insider risk programs.
Conference and Professional Organization Screening
The business unit also created a process through which employees could ask the security team to assess professional conferences and organizations before participating. That allowed employees to continue engaging in legitimate professional activities while giving the company a way to evaluate potential risks before an employee entered an unfamiliar environment or relationship.
Stronger Data Loss Monitoring
The Security Operations Center developed additional protocols for monitoring data loss prevention activity associated with the business unit. Those changes enabled the company to strengthen visibility into potentially unauthorized attempts to move sensitive information and improve the connection between technical controls and the organization’s broader understanding of insider risk.
Together, these changes demonstrate an important principle: intelligence is most valuable when it informs action. While understanding that certain employees may be targeted is useful, the most resilient organizations use that understanding to update policies, training, detection, and security processes.
Looking Beyond Employees
The PMA also led the organization to examine another potential source of exposure: its supply chain. Vendors, suppliers, contractors, research partners, and other third parties may also have access to sensitive information or become pathways through which risk enters the organization.
The company’s procurement team expanded its third-party and supply-chain risk processes and used Strider Organizations Search to map a portion of its supply chain.
That analysis revealed that a longtime partner had significant ties to the PRC. In response, the company substantially modified the relationship, reducing the amount of information shared with the partner and limiting its access to sensitive materials.
Once again, the value came from connecting information that had previously existed in separate organizational silos.
Strider’s PMA helped identify where the organization’s program could improve: by connecting information that had previously existed in separate organizational silos; identifying who and what was being targeted; adding context around individual approaches; and analyzing their supply chain to reveal previously unseen organizational relationships. Then, the company’s leadership was able to translate these findings into tangible, operational changes.
What Proactive Insider Risk Looks Like
This example illustrates why program maturity cannot be measured solely by the number of security tools an organization owns or the number of policies it has written.
A mature insider threat program connects those security capabilities.
It begins with an understanding of the organization’s most valuable assets and expertise.
It considers which employees may be attractive targets.
It gives those employees meaningful information about the threats they could encounter.
It creates clear mechanisms for reporting concerning interactions.
It combines human reporting, technical signals, and external intelligence.
And when risk is identified, it gives HR, security, legal, procurement, and leadership a framework for responding together.
That is how an organization moves from reacting to insider threats toward anticipating them.
From Awareness to Action
Insider Threat Awareness Month begins with awareness, but it should not end there.
Strider’s findings show that most organizations already understand that insider risk matters. Across the 41 PMAs conducted by Strider between 2025 and 2026, the average program maturity score was 2.8 out of 5. Organizations have built many of the foundations, but the next stage of maturity requires turning those foundations into capabilities that are measurable, integrated, and proactive.
That means asking more specific questions, such as: Which technologies and information are most valuable to our organization? Who has access to them? Which employees possess expertise that a foreign actor may want? What external organizations and relationships could create risk? Do employees understand how they may be approached? And if they report something concerning, does the organization have the intelligence, governance, and processes necessary to act?
An effective insider risk program is not about treating every employee as a potential threat.
It is about giving organizations and their people the information they need to recognize risk earlier and creating the systems necessary to respond before that risk becomes an incident.
The company discussed above demonstrated how Strider’s PMA was used as the starting point.
By identifying targeted expertise, employees at risk, and previously unseen relationships, the organization was able to strengthen its security posture across its workforce, technical environment, travel policies, and supply chain.
That is what moving from awareness to action looks like and what a proactive insider threat program is designed to achieve.
Strider’s full e-book, “How Your Organization’s Insider Threat Program Compares: Benchmarking Against Strider’s Insider Threat Program Maturity Assessment,” is available for download here.
