Which of the following indicators suggests a potential insider threat?

• A. Regular access attempts but no anomalies.
• B. Perfect adherence to all security protocols.
• C. Unusual access patterns, unauthorized devices, attempts to bypass security, or repeated anomalies; report and investigate per policy.
• D. Only using personal devices on break.

Answer: (C)

Insider threat indicators come from behaviors that depart from how a typical authorized user normally acts. The strongest signal is when someone shows unusual access patterns, uses unauthorized devices, attempts to bypass security controls, or exhibits repeated anomalies. These signals suggest the person may be trying to access information beyond their role or evade monitoring, which is exactly why such behavior should be reported and investigated according to policy.

Regular access with no anomalies points to normal activity, so it doesn’t raise concern. Perfect adherence to all security protocols is unrealistic and, while desirable, doesn’t by itself indicate a threat. Using personal devices on break can create risk, but on its own doesn’t establish insider threat unless accompanied by other suspicious actions.