How should suspected insider misuse be reported?¶

Report technical activity, legitimate role, authority breach, person, intent, harm and control weakness separately. The label malicious insider should not replace that analysis.

State precise propositions¶

Identify account and system events, device and session evidence, affected data or service, permitted purpose, action outside authority, resulting harm and alternatives. Account access is not personal theft; copying is not necessarily disclosure; policy breach is not automatically criminal intent.

Where motive cannot be resolved, state supported accidental, coerced, reckless or deliberate alternatives. Technical facts may still justify containment or review.

Separate organisational enablement¶

Excessive permissions, shared accounts, weak monitoring and poor offboarding can create opportunity without excusing misuse. Record them as distinct control and remediation findings.

Explain evidence gaps and the confidence of personal attribution. This prevents organisational failure being used either to blame an account holder or erase individual action.