Insider risk management is software that watches for employees, contractors and partners who misuse their access to company data, most often by taking the data with them when they leave. An insider is anyone who already has a valid login. So the usual defences against outside attackers do not stop an insider.
Many insiders are not criminals. Some are careless. Some believe that a list they worked on belongs to them. But the most common serious case is the leaver: an employee who has resigned, and who copies customer data before the last day.
Imagine a regional sales manager at a pharmaceutical distributor in Lucknow. He resigns to join a rival company, and starts his 30-day notice period. Two days later, he exports the list of 4,200 chemist shops and their order histories from the company's sales software. He renames the file "family_photos", puts it inside a zip file locked with a password, and copies the zip file to a USB drive.
A data loss prevention (DLP) rule that reads file contents would miss this. The zip file is locked, so its contents cannot be read, and its name looks harmless. Insider risk software does not need to read the contents. It follows each piece of data from where it was created. It recorded that this file came from an export of the sales software, that it was renamed and zipped, and where it went next. This record of a file's history is called data lineage. So the zip file is still known to be the customer list.
The software also adds context. The HR system has marked the manager as a leaver. A leaver copying customer data to a USB drive is a far stronger warning sign than the same action by someone who is staying. So the software raises his risk score from 12 to 88 out of 100, blocks the copy and alerts the security team. The case then goes to a small group that usually includes HR and legal staff as well as security.
This part is close to user and entity behaviour analytics (UEBA), which learns the normal behaviour of every account. UEBA studies what an account does. Insider risk software follows the data. Its alerts are sent to the SIEM, and it uses the labels from data security posture management (DSPM) to know which data matters most.
Watching employees this closely raises questions of its own. Companies usually tell staff, in their written policies, that work devices are monitored, and they limit who may read the records.