Social Media Monitoring

A subject makes comments either in-person or online that can damage the organization's brand through association.

A subject uses organizational resources, such as internet access, email, or work devices, for personal activities both during and outside work hours, exceeding reasonable personal use. This leads to reduced productivity, increased security risks, and the potential mixing of personal and organizational data, ultimately affecting the organization’s efficiency and overall security.

A subject engages in unauthorized conduct that amounts to harassment or discriminatory behavior within the workplace, targeting individuals or groups based on protected characteristics, such as race, gender, religion, or other personal attributes. Incidents of harassment and discrimination may expose the organization to legal risks, potential reputational damage, and regulatory penalties. Additionally, individuals affected by such behavior may be at higher risk of retaliating or disengaging from their work, potentially leading to further insider risks.

A subject is motivated by political, philosophical, religious, social, or other ideological beliefs to engage in an infringement against an organization. Such infringements may include unauthorized access, data exfiltration, destruction of information, sabotage, or violations of organizational policy undertaken to advance, defend, or draw attention to a particular cause or belief system.

Ideological motivation arises when a subject's beliefs influence their decision to act against the interests or established rules of an organization. The subject may perceive their actions as morally justified, necessary, or consistent with a broader political, philosophical, or social objective, even where those actions result in organizational harm.

During an investigation, ideological motivation should be established through evidence linking the subject's expressed objectives or beliefs to the infringement. The possession or expression of ideological beliefs alone does not establish malicious intent or constitute evidence of an insider threat.

A subject may be motivated by personal, financial, or professional interests that directly conflict with their duties and obligations to the organization. This inherent conflict of interest can lead the subject to engage in actions that compromise the organization’s values, objectives, or legal standing.

For instance, a subject who serves as a senior procurement officer at a company may have a financial stake in a vendor company that is bidding for a contract. Despite knowing that the vendor's offer is subpar or overpriced, the subject might influence the decision-making process to favor that vendor, as it directly benefits their personal financial interests. This conflict of interest could lead to awarding the contract in a way that harms the organization, such as incurring higher costs, receiving lower-quality goods or services, or violating anti-corruption regulations.

The presence of a conflict of interest can create a situation where the subject makes decisions that intentionally or unintentionally harm the organization, such as promoting anti-competitive actions, distorting market outcomes, or violating regulatory frameworks. While the subject’s actions may be hidden behind professional duties, the conflict itself acts as the driving force behind unethical or illegal behavior. These infringements can have far-reaching consequences, including legal ramifications, financial penalties, and damage to the organization’s reputation.

A subject is motivated to undertake an infringement as a result of a materially incorrect understanding of circumstances, events, or perceived threats. The subject's actions are based on factual assumptions that are demonstrably false or inconsistent with established evidence, rather than an accurate understanding of the situation.

This may include a subject who incorrectly believes organizational systems have been compromised, that colleagues are acting against them, or that particular information or assets present a threat requiring intervention. Acting on these misconceptions, the subject may undertake actions they believe are necessary or justified, despite the absence of the circumstances they perceive.

During an investigation, the subject's understanding of events should be assessed against corroborating evidence. Investigators should establish whether a material factual misconception influenced the infringement and avoid inferring a psychiatric condition solely from the subject's statements or behavior.

Resentment is a sustained internal feeling of injustice, bitterness, or perceived mistreatment that may develop over time within a subject. While not always leading to overt action, resentment alters the subject’s psychological orientation toward the organization or its members, potentially lowering thresholds for future misconduct.

Resentment often originates from subjective perceptions of unfairness—such as feeling overlooked, underappreciated, marginalized, or treated unequally. It may be directed at individuals (e.g., managers, peers) or the organization itself. Unlike motives that are reactive or sudden, resentment is typically a chronic state that develops quietly and may go undetected in traditional monitoring systems.

Resentment should be viewed as a risk amplifier rather than an immediate driver of malicious action. It often lays the psychological groundwork for escalation into more active motives, including retaliation or sabotage. Intervention strategies may be more effective during this stage than after escalation.

A subject deliberately engages in an infringement with the intention of being discovered and subjected to disciplinary, professional, or legal consequences. Unlike subjects who attempt to conceal their actions or avoid accountability, the subject seeks an adverse personal outcome, such as disciplinary proceedings, dismissal, or damage to their professional standing.

Self-sabotage may arise from dissatisfaction with employment, a desire to force an end to an employment relationship, feelings of guilt, or an intention to provoke intervention by the organization. The subject may deliberately disregard established controls, commit conspicuous policy violations, or leave evidence of their actions to increase the likelihood of detection.

During an investigation, self-sabotage should be considered where evidence indicates that discovery and personal consequences were intended outcomes of the infringement. The presence of reckless behavior, repeated policy violations, or apparent indifference to disciplinary action does not, in isolation, establish a self-sabotage motive.

A subject misuses social media platforms to engage in activities that violate organizational policies, compromise security, disclose confidential information, or damage the organization’s reputation. This includes sharing sensitive data, making unauthorized statements, engaging in harassment or bullying, or undertaking any actions that could risk the organization’s digital security or public image.

Anti-trust or anti-competition violations occur when a subject engages in practices that unfairly restrict or distort market competition, violating laws designed to protect free market competition. These violations can involve a range of prohibited actions, such as price-fixing, market division, bid-rigging, or the abuse of dominant market position. Such behavior typically aims to reduce competition, manipulate pricing, or create unfair advantages for certain businesses or individuals.

Anti-competition violations may involve insiders leveraging their position to engage in anti-competitive practices, often for personal or corporate gain. These violations can result in significant legal and financial penalties, including fines and sanctions, as well as severe reputational damage to the organization involved.

Examples of Anti-Trust or Anti-Competition Violations:

• A subject shares sensitive pricing or bidding information between competing companies, enabling coordinated pricing or market manipulation.
• An insider with knowledge of a merger or acquisition shares details with competitors, leading to coordinated actions that suppress competition.
• An employee uses confidential market data to form agreements with competitors on market control, stifling competition and violating anti-trust laws.

Regulatory Framework:

Anti-trust or anti-competition laws are enforced globally by various regulatory bodies. In the United States, the Federal Trade Commission (FTC) and the Department of Justice (DOJ) regulate anti-competitive behavior under the Sherman Act, the Clayton Act, and the Federal Trade Commission Act. In the European Union, the European Commission enforces anti-trust laws under the Treaty on the Functioning of the European Union (TFEU) and the Competition Act.

A third party private organization deploys an individual to a target organization to covertly steal confidential or classified information or gain strategic access for its own benefit.

A subject facing financial difficulties attempts to resolve their situation by exploiting their access to or knowledge of the organization. This may involve selling access or information to a third party or conspiring with others to cause harm to the organization for financial gain.

A subject uses personal social media accounts to post statements or other media that can result in brand damage through association between the subject and their employer.

A subject uses existing access to social media accounts owned by the organization to post statements or other media that can result in brand damage.

A subject may misuse a corporate credit card for their own benefit by making purchases that are not aligned with the intended purpose of the card or by failing to follow the policies and procedures governing its use.

A subject that self reports hours worked, and/or is eligible to claim overtime or an individual responsible for reporting such working time may falsify time records or make false representations to a working time system to cause payment or time in lieu for unperformed work.

A subject with access to sensitive or confidential information may decide to use that information to trade the company's stock or other securities (like bonds or stock options) based on significant, nonpublic information about the company.

A subject with access to a billing system or indirect access to a billing system misuses their access to modify existing invoices, causing payments to be diverted to themselves, a business they own, or a third party.

A subject misuses their direct or indirect access to dishonestly redirect funds to an account they control or to a third party.

A subject steals other digital assets, such as monitors, hard drives, or peripherals, belonging to an organization.

A subject steals a corporate mobile phone belonging to an organization for personal use, financial gain, transfer to a third party, or unauthorized access to organizational communications, information, and services.

The theft may result in financial loss, operational disruption, or exposure of organizational information and authentication mechanisms associated with the device. The nature and extent of the impact depend on the subject's intended use of the device, its configuration, and the security controls in place.

A subject steals a corporate laptop belonging to an organization for personal use, financial gain, transfer to a third party, or unauthorized access to the information and systems associated with the device.

The theft may result in financial loss, operational disruption, or exposure of organizational information stored on or accessible through the laptop. The nature and extent of the impact depend on the subject's intended use of the device, the information it contains, and the security controls in place.

The subject leverages synthetic identity elements, AI-generated visuals, deepfake video, or falsified credentials to obtain employment or contractor status under a false identity. This tactic is commonly used to gain insider access to an organization while avoiding standard background checks, attribution mechanisms, or compliance controls.

Common methods include:

• Using AI-generated (GAN-based) profile photos that cannot be reverse-image searched.
• Employing real-time deepfake tools during video interviews to alter facial appearance or impersonate another individual.
• Substituting a more technically skilled individual to complete a remote hiring assessment or interview under a fabricated identity.
• Presenting credentials or documentation (e.g., CVs, diplomas, certifications) created using forgery tools or generative AI.

This tactic is particularly dangerous when used to embed individuals in sensitive roles such as DevOps, system administration, SOC analyst, or software engineering, where access to production systems and intellectual property is granted shortly after onboarding.

Example Scenarios:

• A subject uses a synthetic LinkedIn profile with AI-generated imagery and falsified work history to apply for a remote DevOps role. During the live video interview, they use a deepfake overlay to match their fabricated profile photo.
• A technically skilled individual conducts a coding interview using a deepfake of another person, allowing a less qualified "puppet" to be hired under false credentials. The qualified subject later assists or directs actions remotely.
• A malicious actor obtains employment under an assumed identity to infiltrate a target organization on behalf of a third party, using synthetic documents and deepfake liveness checks to pass onboarding.

The subject is coerced by a third party into harmful or otherwise policy-violating activity through explicit or credible threats of violence, either directed at themselves or at others (e.g., family members, colleagues). This type of coercion often includes real-world intimidation, such as direct verbal or written threats, or more ambiguous references that imply the actor possesses the means or knowledge to inflict physical harm.

Examples may include:

• Stated intent to harm the subject’s family unless a system is accessed or data is provided.
• Demonstrations of knowledge of personal routines or addresses.
• Implied physical threat (“We know where you work.” / “Think about your daughter.”) intended to coerce compliance.

In some cases, the coercive actor may belong to or adopt the tactics and posture of organized crime groups or hybrid cyber-physical groups, lending credibility to the threat. The subject’s response may be reluctant, sudden, and inconsistent with previous behavior, reflecting actions taken under acute psychological and physical duress.

This motive reflects extreme coercion and requires careful investigative sensitivity. It may also intersect with criminal law, necessitating immediate coordination with internal legal teams, law enforcement, and/or protective services. In almost all such cases, the organization has a duty to treat the subject as a victim of crime.

A subject owns, operates, advises, supports, or materially benefits from an external business whose activities or interests conflict with their responsibilities to the organization.

The external interest may include a private company, consultancy, partnership, directorship, freelance operation, side business, or commercial activity conducted through another person. The business does not need to be a direct competitor. A conflict may also arise where it supplies similar services, seeks access to the same customers, depends on organizational resources, or could benefit from information available through the subject’s role.

The subject may use organizational working time, information, equipment, personnel, customer relationships, intellectual property, or decision-making authority to support the external business. They may also direct opportunities away from the organization, influence supplier or customer decisions, or conceal the extent of their involvement.

Investigators should establish the subject’s ownership, management, advisory, or beneficial relationship with the external business and determine whether it was disclosed. Relevant evidence may include corporate records, professional profiles, business websites, invoices, communications, device activity, customer contact, use of organizational resources, and work performed during contracted hours.

This Sub-section should be distinguished from IF038 – Undisclosed Concurrent Employment. Undisclosed Concurrent Employment captures the infringement of maintaining or performing undisclosed external work where disclosure is required. External Business Interest describes the conflict acting as a motive that may influence a wider range of harmful conduct.

A subject knowingly collaborates with an external individual, organization, or other third party to facilitate an infringement in exchange for an anticipated personal benefit. This may involve financial compensation, material rewards, professional opportunities, or other forms of personal advantage.
 

The arrangement may be initiated by the subject or the third party and can involve the unauthorized disclosure of organizational information, provision of access to restricted resources, manipulation of internal processes, or other actions intended to benefit the external party.
 

The defining characteristic is the subject's willingness to misuse their organizational position or access as part of a mutually beneficial arrangement. The anticipated personal benefit distinguishes this motivation from third-party involvement driven primarily by coercion, ideology, or other motives.