Insider risk has advanced significantly from the former disgruntled employees. Today, insider risk is a predictive, intelligence-driven problem that affects every industry, from healthcare and maritime to defense and critical infrastructure, because of the convergence of AI, hybrid work, and increasingly blurred organization perimeters. Organizations are being forced to rethink how they identify, prevent, and respond to internal risks such as shadow AI, synthetic identities, and rapid data exfiltration that are reshaping the threat landscape.
Government Technology Insider spoke with the Defense Strategies Institute (DSI) Production team, organizers of the National Insider Risk Symposium, to discuss how agencies and enterprises are changing how they approach this complex challenge. Ahead of the symposium, taking place September 15-16, 2026, the team shared insights on how to balance the adoption of AI with emerging security risks, shifting toward proactive and behavior-based prevention models, and building cross-functional collaboration between security, HR, legal, and IT needed to protect both mission-critical systems and workforce trust.
Government Technology Insider (GTI): As organizations become increasingly digital and interconnected, how is the insider risk landscape evolving, and what emerging threats are creating the greatest concern for government and industry leaders today?
DSI Production Team (DSI): The insider risk landscape is one of the most complex and critical security challenges facing both government and industry leaders. As organizations become increasingly digital and interconnected, the insider risk landscape has evolved from reactive investigations of disgruntled employees into a complex challenge driven by predictive intelligence and blurred work perimeters. While insider threats have always existed, modern technologies, particularly AI, along with shifting tactics and motivations, have increased both the likelihood and impact of insider-related incidents.
Today’s greatest concerns for government and industry leaders include the rise of shadow AI (where employees inadvertently leak proprietary data into public generative models), sophisticated synthetic identities and remote infiltration by advanced adversaries, ideologically motived insider sabotage, and rapid data exfiltration through hybrid work and cloud channels. Mitigating these modern threats requires organizations to adopt robust insider risk management programs while carefully balancing security with employee trust.
GTI: Artificial intelligence is transforming both cybersecurity operations and workforce productivity. How are organizations balancing the benefits of AI adoption with the new insider risks and security challenges these technologies may introduce?
DSI: Organizations are increasingly viewing AI adoption and security as two sides of the same equation. The goal is not to slow innovation, but to ensure that AI is introduced with the appropriate governance, security controls, and workforce practices in place.
A key priority is understanding where AI is being used, what data employees and systems are providing to AI tools, and what those tools are capable of accessing or generating. Organizations are strengthening policies around sensitive data, access controls, identity and authentication, third-party AI platforms, and the use of AI-generated content. At the same time, security teams are updating monitoring and detection capabilities to account for new risks such as data leakage, prompt manipulation, compromised AI systems, and the potential misuse of AI by insiders.
The workforce component is equally important. Employees need clear guidance on responsible AI use, along with training that helps them understand both the productivity benefits and the security implications. Rather than treating employees as the weakest link, organizations can make them an active part of the security strategy by establishing clear expectations and providing safe, approved AI tools.
Ultimately, successful AI adoption requires a risk-based approach: organizations should encourage responsible experimentation and productivity gains while maintaining strong governance, transparency, human oversight, and security controls. The organizations that will benefit most from AI are those that build security into adoption from the outset rather than treating it as an afterthought.
GTI: Traditional insider threat programs often focus on detection after suspicious activity occurs. How are agencies and enterprises shifting toward more proactive approaches that emphasize prevention, behavioral insights, and early intervention?
DSI: Organizations are increasingly moving beyond a purely detection-based approach to insider risk and toward strategies that emphasize prevention, context, and early intervention. Rather than waiting for an incident to occur, agencies and enterprises are using a combination of behavioral insights, identity and access data, and security analytics to better understand patterns that may indicate elevated risk.
A proactive approach starts with understanding normal behavior and identifying meaningful deviations, while taking care to distinguish genuine risk from legitimate changes in an employee’s role or responsibilities. Organizations are also applying risk-based access controls, least-privilege principles, stronger identity protections, and data-loss prevention measures to reduce opportunities for misuse before an incident occurs.
Behavioral analytics and AI can further enhance these efforts by helping security teams correlate signals across systems and prioritize situations that require immediate attention. Most importantly, these capabilities should support, not replace human judgement. Early intervention may involve additional training, adjusting access privileges, engaging managers or security personnel, or providing support to an employee before a situation escalates.
The broader shift to a prevention-oriented mindset allows organizations to protect sensitive information and systems while also establishing a more balanced, risk-based approach to insider security.
GTI: Effective insider risk management requires collaboration across security, HR, legal, IT, and leadership teams. What are the biggest challenges organizations face in building a truly integrated and organization-wide insider risk strategy?
DSI: One of the biggest challenges in building an effective insider risk strategy is that responsibility for the risk is distributed across the organization. While the security team may own the technology and monitoring, HR may have insight into workforce issues, legal and privacy teams may establish important work boundaries, IT manages access and systems, and leadership sets organizational priorities. Without a common framework in place, these groups can operate independently, making it difficult to successfully identify risks early and respond effectively.
Another challenge is balancing security with privacy, employee trust, and operational needs. Insider risk programs must be designed carefully so that organizations can identify meaningful indicators of risk without creating a culture of unnecessary surveillance. Clear policies, defined roles and responsibilities, appropriate data governance, and strong oversight are essential to maintaining that balance.
Organizations also face challenges in connecting data and processes across traditionally separate functions. Effective insider risk management requires the ability to bring together information about identity, access, security events, workforce changes, and other relevant signals while ensuring that the information is used appropriately and consistently.
Ultimately, an organization-wide strategy depends as much on governance and culture as it does on technology. The most mature programs establish clear accountability, create trusted channels for collaboration, and define in advance how potential risks will be assessed and escalated. When security, HR, legal, IT, and leadership operate from a shared understanding of risk, organizations are better positioned to intervene early while protecting both the organization and its workforce.
GTI: Identity has become a central component of modern security architectures. How are organizations leveraging identity intelligence, behavioral analytics, and continuous evaluation capabilities to better understand and mitigate insider risk?
DSI: Identity has become one of the most important sources of context for understanding insider risk because it connects a person or account to the systems, data, applications, and resources they are authorized to access. Organizations are increasingly moving beyond static access controls and using identity intelligence to understand whether access is appropriate based on factors such as role, device, location, time, behavior, and the sensitivity of the information involved.
Behavioral analytics adds another layer of context by establishing a baseline for normal activity and identifying meaningful deviations. For example, an unusual change in access patterns, unexpected data movement, or activity that differs significantly from an individual’s typical behavior may warrant additional scrutiny. The value is not in treating every anomaly as malicious, but in correlating multiple signals to help security teams distinguish legitimate activity from potentially risky behavior.
Continuous evaluation is also becoming increasingly significant for insider risk management teams. Instead of treating authentication or authorization as a one-time decision, organizations can continually reassess risk as circumstances change. If an account’s risk profile increases, organizations can respond accordingly, such as requiring additional authentication, restricting access, enhancing monitoring, or involving appropriate security personnel for further review.
The combination of identity intelligence, behavioral analytics, and continuous evaluation allows organizations to employ a more dynamic, risk-based security model. It provides security teams with greater visibility into who is accessing what, why they are accessing it, and whether that activity is warranted or appropriate. When implemented correctly and effectively, these capabilities can help organizations identify potential insider risk earlier while minimizing unnecessary disruption to legitimate users.
GTI: Critical infrastructure sectors—including energy, healthcare, transportation, and defense—face unique insider risk challenges. How are operators balancing workforce trust, operational requirements, and security controls to protect mission-critical systems and data?
Critical infrastructure operators face a particularly difficult balance because security cannot come at the expense of availability, safety, or mission continuity. In environments such as energy, healthcare, transportation, and defense, employees and contractors often require legitimate access to highly sensitive systems in order to perform essential functions. The challenge is ensuring that access enables the mission while limiting unnecessary exposure to critical systems and data.
Organizations are increasingly taking a risk-based approach built around least privilege, strong identity and access management, separation of duties, and continuous monitoring. Rather than assuming that a trusted employee or contractor remains low risk indefinitely, organizations are evaluating access and behavior in context and adjusting controls as roles, circumstances, or risk levels change. This is particularly important for privileged accounts and operational technology environments where a compromise could have significant real-world consequences.
At the same time, workforce trust remains essential. Effective insider risk programs should not create an environment where employees feel they are constantly being monitored or presumed to be a threat. Clear policies, security awareness training, well-defined responsibilities, and transparent processes for addressing concerns can help establish a culture where security is viewed as a shared responsibility.
The strongest programs also recognize that technology alone cannot solve the problem. Close coordination among cybersecurity, physical security, operations, HR, legal, and leadership is critical to understanding the operational context behind potentially risky activity and determining an appropriate response.
GTI: Looking ahead, what role will emerging technologies such as AI-enabled risk analytics, predictive behavioral modeling, continuous monitoring, and human-centric security frameworks play in shaping the future of insider risk management?
DSI: Looking ahead, emerging technologies will help move insider risk management from a strictly reactive model toward one that is more predictive and contextual. AI-enabled risk analytics and behavioral modeling can help organizations identify meaningful changes in activity and connect signals across identity, access, and security data, allowing teams to focus on risks that warrant attention earlier.
Continuous monitoring will also enable organizations to reassess risk as circumstances change, rather than relying on point-in-time decisions about access or trust. This can support more targeted and proportionate interventions.
At the same time, the human element will remain critical. AI should augment, not replace, human judgement, with appropriate privacy safeguards, transparency, and oversight. The goal is for the future of insider risk management to be about using technology to better understand context and intervene earlier while maintaining workforce trust.
Learn more about the future of risk management and register for the National Insider Risk Symposium here.