Bridging the Silos: Protective Intelligence as the Core of Insider Threat Programs

By J Damien Scott, Trusted Advisor

Organizations with a formal, cross-functional insider risk management program avoid an average of seven major insider incidents per year, resulting in approximately $8.2 million in avoided breach costs. Yet only 63% of organizations currently operate such a program. The structural failure is not a lack of data. It is a failure to connect the data that already exists across organizational silos.

The Failure of Siloed Security

In a siloed environment, HR sees a performance issue. IT sees a minor anomaly in access logs. Physical Security sees a minor access control violation. No single department has the full picture, so no intervention occurs. The organization is operating right of boom, waiting for the data breach or the workplace violence incident to happen before connecting the dots.

The 2026 Ponemon/DTEX data reinforces this structural failure. Organizations with a formal, cross-functional insider risk management program avoid an average of seven major insider incidents per year, resulting in approximately $8.2 million in avoided breach costs. Yet only 63% of organizations currently operate such a program.

“Insider risk does not live in one department. It lives in your people, your systems, your culture, and your processes.”

Protective Intelligence as the Connective Tissue

Protective intelligence provides the analytical framework that connects the disparate data streams that insider threat programs depend on. A PI function integrated with HR, IT, legal, and physical security can synthesize behavioral indicators, access anomalies, performance data, and open-source information into a coherent threat picture that no single department can produce alone.

The AI Dimension and the Strategic Imperative

AI-enabled behavioral analytics can improve detection sensitivity and reduce the analytical burden on human analysts. They cannot replace the human judgment required to assess context, evaluate intent, and make the consequential decisions that insider threat investigations require.

The strategic imperative is to build the cross-functional infrastructure that makes both human and AI-enabled detection effective. Organizations that treat insider threat as an IT problem, an HR problem, or a security problem, rather than an enterprise risk problem, will continue to be surprised by the incidents that their siloed programs cannot see.

Protective IntelligenceInsider threatProtective intelligenceCross-functional security

Originally published on LinkedIn. Read it there

Field Notes · by email

Field notes on converged security from J Damien Scott, Trusted Advisor: the article, its summary, and the phase it belongs to. No digests, no offers, no third party reading over your shoulder.

Subscribe by RSS

Email delivery is being set up. The feed carries every article the day it publishes. About Field Notes

Moving "Left of Boom": The Strategic Value of Protective Intelligence

Executive targeting incidents doubled in 2025. A corporate security program that relies solely on gates, guards, and guns is not just outdated. It is a critical vulnerability. Protective intelligence moves the organization left of boom by identifying, assessing, and dismantling threats before they cross the threshold of the enterprise.

7 min read

Align · January 2026

The Intelligence-Led Executive Protection Detail

The era of the visible deterrent is over. The modern executive protection detail must evolve from a logistics-heavy guarding function into a dynamic, intelligence-driven operation. It is no longer about how close you stand to the principal. It is about how far ahead you can see.

8 min read

Learn · January 2026

Decoding the Pathway to Violence: Behavioral Threat Assessment in Corporate Settings

Targeted violence is rarely spontaneous. It is the result of an understandable, evolving, and often discernible process of thinking, behavior, and preparation. Understanding the Pathway to Violence allows corporate security programs to identify warning behaviors and intervene before an attack occurs.

9 min read