Could an insider be coerced or manipulated?¶

Yes. A person may use legitimate access after threats, deception, bribery, impersonation or social pressure. The account action can be intentional while the person's knowledge, motive and responsibility differ from those of an external organiser.

Reconstruct instruction and belief¶

Preserve original communications, accounts and verification steps, what the insider was shown, the instruction or pressure, resulting action and opportunity to refuse or report. Assess belief from information available at the time, not only what investigators later know.

A claim of coercion should be tested against timing, behaviour and communications rather than accepted or rejected from the technical action alone.

Follow benefit and external control¶

Financial evidence may support recruitment or corruption, but money receipt does not identify what it purchased. Link payment, instruction and system activity.

The recruiter, controller or beneficiary may be more significant than the insider account. Report the insider's technical act, their state of knowledge and the directing relationship as distinct propositions.