Insider Threat Investigations When the risk already has a badge, a login and your trust

01Definition

What insider threat investigations are and when they are needed

An insider is anyone the organisation has trusted with access: employees at every level, contractors, temporary staff, consultants, joint venture personnel, outsourced IT providers and people who have recently left but whose access, knowledge or relationships linger. An insider threat is the risk that one of them, deliberately or through serious carelessness, uses that access to harm the organisation. Insider threat investigations are the response when that risk appears to have materialised.

The triggers vary. A data loss prevention alert flags a large upload to a personal account. A resignation is followed by a competitor launching a strikingly similar product. A hotline report alleges that a manager is steering contracts to a company owned by a relative. Accounts payable notices a vendor whose bank details match an employee's. A system administrator under notice runs commands nobody expected. Each of these is a question about what a trusted person did, and each needs facts before anyone decides what to do about it.

These cases differ from external cyber incidents in one important way: the subject is known, employed or recently employed, and has rights. Employment law, data protection law, works council agreements, whistleblower protections and, in some countries, criminal procedure all shape what an employer can examine and how. Insider threat investigations therefore have to be as careful about method as about findings. Evidence gathered unlawfully can be excluded, can expose the employer to claims and can turn a strong case into a costly one.

Delator Group consultants lead these engagements, often working through outside counsel. Digital work is carried out only on systems the client owns or controls and only under a written authorization signed by the system owner. Fact-finding, document review and interviews are planned with counsel in each jurisdiction involved, and the conclusions are reported in a form that supports whatever decision the employer and its advisers make.

02Types

Common types of insider threat cases

Most insider threat investigations fall into a handful of patterns. Recognising the pattern early helps decide which data sources matter, who needs to be involved and how quickly evidence must be preserved.

Negligent and compromised insiders

Not every insider incident is malicious. An employee who emails a sensitive file to the wrong recipient, or whose credentials are stolen through phishing, creates insider-type exposure without intent. Investigations in those cases focus on scope and remediation rather than discipline, and the conclusion should say clearly when the evidence points to error or external compromise rather than misconduct.

Privileged administrators, contractors and third-party insiders

The most damaging insiders are often not employees at all. Outsourced IT providers, managed service staff, offshore development teams and contractors frequently hold administrator rights that exceed anything an ordinary employee has. When one of them misuses that access, the evidence may sit partly in the client's systems and partly in the provider's, and the contract governing the relationship decides what the client can demand.

Investigations involving third-party insiders begin with the contract: audit rights, security obligations, incident notification duties, log retention terms and the provider's own personnel screening commitments. Counsel then decides whether to request cooperation, invoke audit rights or preserve the client's side of the evidence first. Delator's consultants review the client's privileged access records, change management tickets, remote access logs and session recordings where they exist, and prepare targeted requests for the provider's records.

Sabotage cases need particular speed. An administrator who expects to be dismissed may leave scheduled tasks, altered scripts or disabled backups behind. Before access is removed, Delator advises on capturing configuration state, reviewing recent privileged activity and checking for persistence mechanisms, so that the organisation removes the person's access and any traps at the same time.

03First 72 hours

Preserving evidence before it disappears

The early decisions in insider threat investigations often determine the outcome. Logs roll over, devices are wiped and returned, cloud accounts are closed and people who suspect they are under scrutiny delete messages. At the same time, acting too fast, for example by confronting the person or cutting off access in a way that tips them off, can prompt destruction of evidence held outside the company's reach.

Delator's first step is a short call with counsel, HR and security to agree what is known, what needs preserving and what the immediate risks are. Preservation then covers company-owned laptops and phones, email and collaboration accounts, file shares, cloud storage under company control, identity and access logs, and relevant business systems. Each collection is documented with who collected it, when, how and with what tool, and forensic images are verified with hash values.

Containment is planned alongside preservation. Where there is a risk of ongoing harm, such as continued exfiltration or sabotage, access may need to be restricted immediately. Where the risk is lower, it can be better to preserve quietly first and then restrict access at a moment that limits the opportunity to destroy evidence. Legal holds should be issued to custodians whose data matters, and the business should avoid routine reimaging or disposal of the subject's equipment.

• Agree facts known, risks and immediate objectives with counsel, HR and security.
• Issue legal holds and suspend deletion policies for relevant accounts and devices.
• Collect and image company-owned devices and accounts under written authorization.
• Export identity, access, endpoint, email and cloud audit logs before retention periods expire.
• Decide the timing and method of access restriction to balance harm and evidence risk.
• Record every step in a preservation log that counsel can rely on later.

04Digital forensics

Authorised digital forensics in insider threat investigations

Digital evidence answers the questions that witnesses cannot: which files were opened, copied, renamed, compressed, uploaded or deleted, by which account, from which device and at what time. A careful forensic review reconstructs activity minute by minute and shows whether it fits the person's role or departs from it.

Delator's technology consultants work from preserved images and exported logs rather than live systems wherever possible, so that the original evidence remains intact. Typical artefacts include file system metadata, operating system activity records, USB device history, browser history for company accounts, synchronisation client logs, email and messaging records on company platforms, and audit trails from cloud services. The MITRE ATT&CK framework's exfiltration tactics provide a useful common vocabulary for describing how data left, whether over web services, removable media, email or alternative protocols.

Authorization is not a formality. Forensic access is limited to systems the client owns or controls, and the system owner signs a written authorization that defines scope, data sources, date ranges and who may review results. Personal devices and personal accounts are outside scope unless the employee consents or a court orders production. Where the employer's policies allow some personal use of company devices, the review protocol filters out obviously private material and is designed with counsel to respect local privacy law.

Results are reported in plain language with the technical detail available in appendices. A finding that a departing employee copied a particular folder to a removable drive the evening before resigning is useful only if the report shows how that conclusion was reached and what alternative explanations were considered and ruled out.

05Cross-border law

Employment, privacy and works council rules across jurisdictions

Multinational employers quickly learn that what is routine in one country is prohibited in another. U.S. employers can generally review company systems under clear acceptable use policies. In much of Europe, employee monitoring and investigation must meet proportionality and transparency requirements, and in some countries employee representatives must be involved before technical monitoring is introduced. Insider threat investigations that span several countries need a plan that works in each of them.

Under the EU GDPR, processing employee data in an investigation needs a lawful basis, commonly legitimate interests supported by a documented balancing test, and must be limited to what the purpose requires. Where processing is likely to result in a high risk to individuals, a data protection impact assessment may be required. Article 88 allows member states to adopt more specific rules on employment-related processing, and many have. The European Court of Human Rights, in its 2017 Grand Chamber judgment in Barbulescu v. Romania, held that employees must be informed in advance about the possibility and nature of monitoring of their communications, and that monitoring must be proportionate.

Works councils and similar bodies add another layer. In Germany, for example, the Works Constitution Act gives the works council co-determination rights over the introduction and use of technical devices designed to monitor employee behaviour or performance, and investigation tools may engage those rights. France, the Netherlands and other countries have their own consultation and data protection authority expectations. Data transfers out of the EU or the UK need a valid transfer mechanism.

Delator plans the investigation with counsel in each jurisdiction so that collection, review and transfer of data meet local rules. Sometimes that means reviewing data in-country before transferring only relevant material, using pseudonymisation during early review stages, or sequencing work so that consultation obligations are met before certain tools are used.

06Whistleblowers

Internal investigations triggered by whistleblower reports

Many insider threat investigations begin with a report through a hotline, an email to compliance or a conversation with a manager. Those reports bring legal duties of their own, and how the organisation handles the reporter can matter as much as what the investigation finds.

The EU Whistleblower Directive (Directive (EU) 2019/1937) requires legal entities with 50 or more workers to establish internal reporting channels, to acknowledge receipt of a report within seven days, and to provide feedback within a reasonable timeframe not exceeding three months from acknowledgement. It prohibits retaliation and requires confidentiality of the reporter's identity. Member states have implemented it in national law with variations. In the UK, the Public Interest Disclosure Act 1998 protects workers who make qualifying disclosures. In the United States, SEC Rule 21F-17 prohibits any person from taking action to impede an individual from communicating directly with the SEC about a possible securities law violation, which affects how confidentiality agreements and investigation communications are drafted.

Investigations triggered by whistleblowers need independence and a clear firewall around the reporter's identity. Delator's role is to establish the facts objectively, test the allegations against records and other witnesses, and report to the decision-makers counsel designates, which is often a board committee or general counsel rather than the line management being reported on. The reporter is kept informed through the proper channel without the investigation becoming a vehicle for retaliation.

• Confirm the reporting channel's legal deadlines for acknowledgement and feedback.
• Restrict knowledge of the reporter's identity to those who strictly need it.
• Choose an investigation sponsor independent of the people implicated.
• Review confidentiality language so it does not impede lawful reporting to regulators.
• Document each step so the organisation can show the report was taken seriously.

07Interviews

Interviews and fact-finding with employees

Documents and logs show what happened. Interviews explain why, fill gaps and give the subject a fair chance to respond. In most insider threat investigations, interviews come after the documentary and digital review so that questions are informed by evidence rather than speculation.

Interview planning starts with the order of witnesses, usually moving from peripheral witnesses to those closer to the events and ending with the subject. In the United States, where counsel conducts or directs interviews, employees are typically given an Upjohn warning explaining that counsel represents the company, not the individual, and that the company controls any privilege. Other jurisdictions have their own rules, including rights to be accompanied by a colleague or representative, notice requirements, and limits on how interviews can be recorded.

Delator consultants bring interviewing experience from law enforcement and intelligence backgrounds, adapted to the employment context. That means non-coercive questioning, accurate notes or recordings where lawful and agreed, interpreters where needed, and memoranda prepared promptly after each interview. The subject is shown key documents and given the opportunity to explain them. Conclusions are drawn only once all the evidence, including the subject's account, has been weighed.

08Leaks

Investigating leaks of confidential information

Leak investigations are among the most sensitive internal matters. The information may have gone to the press, a regulator, a competitor or a social media account, and the motives range from grievance to genuine public-interest concern. The legal position varies with the recipient: a disclosure to a regulator or through a protected channel may be lawful and protected, while a sale of confidential pricing to a competitor is not.

The work focuses on narrowing the pool of people who had the information in the exact form that appeared externally. Document management records, distribution lists, version differences, print logs and access histories often reduce a wide circle to a handful of names. Where the leaked version contains features unique to one copy, the pool can narrow further.

Delator scopes leak investigations with counsel from the outset to make sure the inquiry does not become retaliation against a protected whistleblower. Where the evidence suggests the disclosure falls within a protected category, the report says so, and the organisation's response is shaped accordingly. Journalists and their sources are not targets, and methods stay within what the law in each jurisdiction permits.

09Outside the firewall

Following the trail outside the organisation

Some questions cannot be answered from internal records. Did the departing employee's new employer launch a product using the stolen design? Is the vendor paid by the suspect manager owned by a relative? Has customer data appeared for sale online? Answering them requires research beyond the organisation's own systems, carried out lawfully.

Delator consultants carry out corporate registry research, beneficial ownership mapping, litigation and regulatory searches, patent and trademark filing reviews, and open-source intelligence to connect insiders with outside parties. Where the scope includes background checks on employees or other individuals in jurisdictions where local law reserves that work for licensed investigators, Delator leverages a locally licensed partner in its network to complete that work and does not do it itself.

Some activity is off limits. Accessing the subject's personal accounts without consent or a court order, pretexting to obtain protected records, and covert monitoring of private life are outside the boundaries Delator works within. Where a client needs traditional private investigation abroad, such as surveillance of a named person in a separate matter, that is referred to a vetted investigator in Delator's network who holds any licence local law requires and contracts with the client directly.

10Outcomes

Turning findings into action: employment, civil and criminal routes

The final report of an insider threat investigation sets out each allegation, the evidence for and against it, and a conclusion on whether it is substantiated. What happens next is a decision for the employer and its advisers, but the report should be written so that it can support any of the realistic options.

Employment action is the most common outcome. A well-documented investigation supports disciplinary decisions and helps defend them if challenged. Civil action follows where information or money has gone: under the U.S. Defend Trade Secrets Act, owners of misappropriated trade secrets can seek injunctions and damages in federal court, and in extraordinary circumstances an ex parte civil seizure order. EU member states provide remedies under national laws implementing the Trade Secrets Directive. Contractual claims under confidentiality, non-solicitation and intellectual property assignment clauses often run alongside.

A note on the DTSA is worth making for U.S. employers. Section 1833(b) provides immunity for individuals who disclose trade secrets in confidence to government officials or attorneys to report suspected violations of law, and requires employers to give notice of that immunity in agreements governing confidential information. Employers who fail to give the notice cannot recover exemplary damages or attorney fees against an employee to whom notice was not provided.

Criminal referral is a decision for the company and counsel. Some cases, particularly theft of trade secrets for a foreign competitor or government, or significant fraud, warrant reporting to the authorities. Delator's findings and preservation records are prepared so that, if a referral is made, investigators receive evidence with a clear chain of custody.

11Privilege

Privilege and confidentiality in cross-border internal investigations

Privilege rules differ sharply between countries, and investigations that span them need to be structured with that in mind. In the United States, attorney-client privilege and work product protection can cover investigations conducted by or at the direction of counsel, including work by consultants retained to assist counsel. In England and Wales, the Court of Appeal's 2018 decision in SFO v ENRC confirmed that litigation privilege can extend to documents created in an internal investigation where criminal proceedings were reasonably contemplated, though each case turns on its facts. In EU competition investigations, the Court of Justice held in Akzo Nobel that communications with in-house lawyers are not privileged.

Practical steps help. Engagements can be made through outside counsel, with the purpose of supporting legal advice documented in the engagement letter. Reports and interview memoranda can be addressed to counsel and marked appropriately. Distribution can be limited to those who need to know. None of this makes privilege certain, and whether it applies is a matter for counsel under the applicable law, but careful structure gives it the strongest footing available.

Confidentiality matters for reasons beyond privilege. Rumours about an investigation can damage reputations, prompt evidence destruction and expose the employer to defamation claims if allegations turn out to be unfounded. Delator keeps the circle of knowledge small and communicates through agreed channels only.

12Prevention

From investigation to prevention: insider threat programs

Every investigation reveals something about the controls that failed or were missing. An effective insider threat program turns those lessons into prevention, detection and response capabilities that make the next case less likely and easier to handle. The CERT National Insider Threat Center at Carnegie Mellon University's Software Engineering Institute publishes widely used guidance on the elements of such programs, and NIST control families on personnel security and access control provide a structured reference.

Core elements include clear acceptable use and monitoring policies that employees have seen, least-privilege access with regular reviews, structured joiner, mover and leaver processes that remove access promptly, logging that captures the events investigations need, data loss prevention tuned to the organisation's real crown jewels, and a cross-functional team of HR, legal, security and IT that knows how to respond. Programs must also respect privacy law and employee rights, which in some countries means involving employee representatives from the start.

Delator's security consulting work helps organisations design or review insider threat programs, including where screening of new hires or people in sensitive roles is involved. For those background checks on individuals, Delator does not perform the checks itself, and the program design specifies how a locally licensed provider completes them in each country. The goal is a program that is proportionate, lawful and practical rather than one that treats every employee as a suspect.

Insider threat investigations and prevention programs reinforce each other. Investigations supply real evidence about how harm happens inside the organisation, and programs supply the policies, logs and processes that make future investigations faster, fairer and more conclusive.

Step by step

How an Engagement Works

1. 01

   Triage call

   Counsel, HR, security and the Delator case lead agree known facts, immediate risks and the questions the investigation must answer.

2. 02

   Written scope and authorization

   The engagement letter and the system owner's signed authorization define subjects, data sources, jurisdictions and data handling.

3. 03

   Preservation

   Company devices, accounts and logs are collected and imaged with documented chain of custody before data is lost.

4. 04

   Forensic and document review

   Consultants reconstruct activity, review communications on company systems and test the allegations against records.

5. 05

   External research

   Corporate, ownership and open-source research connects insiders to outside parties, with licensed partners completing reserved work abroad.

6. 06

   Interviews

   Witnesses and the subject are interviewed in a planned order, with local procedural rights respected.

7. 07

   Report and next steps

   A final report sets out findings on each allegation and supports employment, civil, criminal or remediation decisions.

Deliverables

What You Receive

• Preservation log recording every device, account and data source collected, with hash values.
• Forensic findings report with a reconstructed timeline of relevant activity.
• Data movement analysis showing what information left, how and where it went where known.
• Interview memoranda for each witness and the subject.
• External research findings on related companies, new employers or recipients.
• Final report with conclusions on each allegation and the evidence behind them.
• Control gap analysis with practical recommendations for prevention and detection.
• Debrief for counsel, HR and leadership on findings and options.

Industries

Who Uses Insider threat Services

• Technology and softwareSource code, product roadmaps and customer data are easy to copy and valuable to competitors.
• Manufacturing and engineeringDesigns, process know-how and supplier pricing are frequent targets for departing staff and partners.
• Financial servicesInsiders with access to client data and payment systems create fraud, privacy and regulatory exposure.
• Life sciences and biotechResearch data and formulations represent years of investment and attract theft by insiders and partners.
• Defense and critical infrastructureInsiders with privileged access to sensitive systems or facilities raise national security and safety concerns.
• Professional servicesClient files, bid information and relationships move with people, especially at partner and senior levels.
• Energy and natural resourcesGeological data, bid strategies and operational technology access are high-value insider targets.

Credentials

Who Does the Work

Delator Global's consultants come from backgrounds where finding facts under pressure is the job: U.S. military intelligence, the Department of Homeland Security, former law enforcement officers of every kind, former bounty hunters, and technology specialists across networks, applications, forensics and data. Behind them sits a network of locally licensed partners holding a wide range of licences and certifications, so every part of an engagement is done by someone entitled to do it in that country.

• Military intelligenceCollection planning, analysis and reporting discipline.
• Homeland securityFederal investigative and border, trade and financial crime experience.
• Law enforcementInterviewing, evidence handling and courtroom testimony.
• Bail enforcementLocating people who do not want to be found, lawfully.
• TechnologyNetwork, application, cloud and forensic specialists.
• Licensed partnersLocal licences for the work local law reserves.

Related services

Related Delator Global Services

• CorporateIP Theft and Counterfeiting InvestigationsIP theft and counterfeiting investigations follow fake goods, diverted products and stolen know-how back to the people and companies behind them, and build the evidence a brand owner needs to act.
• CyberCyber InvestigationsCyber investigations establish what happened during a security incident or digital fraud, how the attacker got in, what they touched, and what evidence exists to support recovery, notification and legal action.
• CorporateInternational Fraud InvestigationsFraud inside a multinational usually hides in ordinary transactions: a vendor that looks legitimate, an expense claim that is slightly too round, a payroll record for someone nobody has met.
• ConsultingInternational Security ConsultingDelator Global provides international security consulting to general counsel, CFOs, CISOs and compliance leaders who need practical advice on risks that cross borders.
• CorporateInternational Corporate InvestigationsInternational corporate investigations rarely stay inside one legal system.

Every Delator Global service

Countries

Where Delator Global Works

Delator Global handles matters in 152 countries, with a country page for each and a city page for every city over 200,000 people. Larger markets are listed below; the full list is on the international page.

• United Kingdom
• Canada
• Mexico
• Germany
• France
• India
• Brazil
• Australia
• Japan
• United Arab Emirates
• South Africa
• Nigeria
• China
• South Korea
• Spain
• Italy
• Netherlands
• Poland
• Turkey
• Philippines
• All 152 countries