A focused intelligence assessment of insider risk connected to a specific employee, role, or department, before it becomes a confirmed incident.
Insider threat rarely announces itself. It surfaces as a pattern: unusual data access, a resignation that follows a competitor's job offer, a contractor with access beyond their role, or a tip that something is not right. Security teams often face a choice between ignoring the signal or launching a full internal investigation on thin evidence, either of which carries risk if handled wrong.
A focused intelligence assessment of a named individual, role or department where insider risk is suspected, combining lawful digital footprint analysis, public record checks, and pattern assessment against known insider threat indicators, to inform whether and how to proceed.
Digital footprint and public activity review for indicators of risk
Assessment against recognised insider threat behavioural indicators
Corporate and financial interest checks for undisclosed conflicts
A clear recommendation on next steps, proportionate to the finding
An optional follow-up monitoring period where a concern is stood down but not entirely closed
Lawful open-source and public record research combined with a structured insider threat indicator framework, conducted discreetly to avoid tipping off the subject before your organisation has decided how to proceed, with every finding verified by a named analyst.
No. This work is conducted discreetly using lawfully obtained information, without contacting the individual or alerting colleagues, so your organisation retains full control over what happens next.
That is a genuinely useful outcome. A clean finding lets you stand down a concern with confidence rather than carrying unresolved suspicion, and is reported as a clean finding, not inflated to justify the engagement.
Yes, where findings warrant it. This brief is deliberately proportionate and often the step before a full Workplace Investigation is commissioned, once there is a documented basis for one.
Unusual data access patterns, a resignation shortly before or after a competitor approach, a tip from a colleague, or access privileges that no longer match a departing employee's role are the most common triggers.
Where a finding does not warrant escalation but the underlying concern has not fully resolved, we can agree a follow-up monitoring period on the same named individual, publicly available information only, rather than instructing a fresh brief each time something changes.
Every enquiry is reviewed by an analyst and routed to a scoping call, a fixed fee is confirmed in writing before any work begins.