Which of the following is a sign of an insider threat?

• A. Unusual access patterns.
• B. Strict adherence to schedules.
• C. No anomalies.
• D. Access granted to outsiders at all times.

Answer: (A)

Unusual access patterns signal an insider threat because someone with legitimate privileges starts behaving in ways that don’t fit their usual role. When a person accesses data, systems, or areas they don’t normally use, or does so at odd hours or from unexpected locations, it indicates misuse of their authorized access. This kind of deviation is a common warning sign of potential data theft, fraud, or sabotage. In contrast, strict adherence to schedules reflects normal, expected behavior; no anomalies suggests nothing seems out of the ordinary, and access by outsiders points to external risk rather than an insider's misuse.