Insider Threat Management: Connecting the Dots Before an Incident

The Institute of Internal Auditors Presents: All Things Internal Audit In this episode, Sanjay Vadlamani talks with Yvette Adams about how insider threats extend beyond malicious employees. They discuss negligent, malicious, and compromised insiders, along with the ways AI, remote work, cloud applications, and expanding access have increased organizational risk. The conversation also covers behavior monitoring, employee privacy, access management, offboarding, multidisciplinary risk teams, and the importance of connecting information across organizational silos before a threat becomes an incident. HOST: Sanjay Vadlamani, CIA, CISA, CRISC Senior Manager, Internal Audit, PayJoy GUEST: Yvette Adams, CIA, CRMA Director of Enterprise Risk Management, Zions Bancorporation KEY POINTS: Introduction [00:00–00:00:38] The Three Types of Insider Threats [00:00:39–00:03:19] How AI, Remote Work, and Cloud Applications Increase Risk [00:03:20–00:06:52] IIA Membership [00:06:53–00:07:38] Balancing Employee Monitoring, Privacy, and Trust [00:07:39–00:11:13] Indicators of Insider Risk [00:11:14–00:15:16] The FinWise Bank Incident and Offboarding Risk [00:15:17–00:18:48] Connecting Information Across Organizational Silos [00:18:49–00:22:47] Five Elements of a Mature Insider Risk Program [00:22:48–00:26:40] <li data-section-id="ejbhwq" data-st