Collin Sampson, VP, Infrastructure and CISO at Expion Health, tells Sean Martin that tools see an authorized insider while coworkers notice change, and that reporting works only where people are not penalized for it.
Your tools see an authorized user doing their job. That is the gap Collin Sampson, VP, Infrastructure and CISO at Expion Health, describes when he talks insider threat with Sean Martin at ISC2 Security Congress in Denver.
Sampson opens with a case from his session: a system administrator logged into an HR system and wrote employees' personal information on paper. He says none of the company's technology would have caught it, and the company learned of it only when law enforcement made contact.
Sean asks what else gets an organization's attention. Sampson says that in a lot of cases the best detection he has found is an employee reporting it, or a supervisor noticing a change in tone, attitude or personality. The security team then looks back at that person's access.
The conversation moves to why tools stall, since the person is authorized, and to where AI might help filter log volume down to the unusual, with some false positives along the way.
Sampson also covers why reporting a colleague goes against the grain, and a company where a manager wanted to hear everything first. That company had to launch new training saying anyone can report anything at any time to compliance and security. Sean closes by asking about AI agents as insiders.
Sampson's account comes from cases and companies he has worked at. Listen for what you can change this quarter: where reports go, who sees them, and whether people feel safe making them.
Read the full story on ITSPmagazine: https://www.itspmagazine.com/blog?p=the-best-insider-detection-is-an-employee-who-can-report-safely