Jamie Lindsay

Insider risk remains one of the most material yet misunderstood business risks facing organisations today. While external cyber threats dominate headlines, the majority of damaging incidents originate from trusted users operating with legitimate access, often without malicious intent. As the adoption of AI tools accelerates, the potential impact of insider risk is increasing while response windows are shrinking.

This session reframes insider risk away from traditional, event‑driven “insider threat” models and instead presents it as a progressive risk trajectory shaped by behavioural insight. Rather than reactively focusing on every single, we focus on where organisations can identify patterns, intervene earlier and more proportionately, leading to preventing incidents before policy breaches or data loss occur.

A central theme is that effective insider risk programs are not driven by technology alone. They succeed when security teams enable the business, aligning cyber capability with HR, Legal, Privacy, and executives around clear governance, shared thresholds, and defensible decision‑making. When done well, insider risk programs reduce harm, protect trust, and improve outcomes for both the organisation and its people.

We will explore how mature programs translate behavioural signals into business impact, apply privacy‑by‑design principles in day‑to‑day operations, and navigate emerging challenges such as AI‑enabled misuse, where ordinary productivity tools can unintentionally create material exposure.