Insider threat detection: a socio-technical analysis of behavioural pathways in malicious insider fraud

Purpose Cybersecurity is inherently interdisciplinary, yet insider threats are often examined through technical or behavioural lenses in isolation. This paper aims to focus on fraud committed by malicious insiders and aims to improve the understanding of how such attacks develop, thereby enhancing detection and prevention. Design/methodology/approach A novel methodological approach is adopted, integrating grounded theory (GT) with behaviour sequence analysis (BSA) to examine socio-technical events. This enables identification of key indicators and the temporal pathways leading to insider fraud. Findings The findings caution against assuming a single, distinct fraudster profile. Within the cases examined, individuals involved in fraud sometimes engaged in other forms of insider misconduct, including intellectual property theft. The results question established frameworks, such as the fraud triangle, by demonstrating the complexity and dynamic nature of insider fraud. In several cases, information concerning offending or intent was communicated through online or face-to-face interactions. The pattern warrants further investigation, as a potential source of detection using natural language processing methods. Practical implications Drawing on situational prevention theory, the paper offers recommendations for organisations, including strengthening access controls and promoting transparency regarding insider incidents to improve detection and prevention. Originality/value This study advances insider threat research by combining GT with behaviour sequence analysis to examine socio-technical behaviour sequences. It identifies preliminary pathways and warning signals within the cases examined, offering an alternative to static profiling approaches.