Who the most dangerous insiders are
Numbers below are frozen at publication. The live, recomputed figures are on EVIDENCE.
Proven insider harm concentrates in the departure window. Departure-linked conduct appears in 511 of 860 method-bearing cases and carries 39 of the 68 proven ones — more than any other pattern. But danger splits by kind: technical insiders are the most provable, executives carry the biggest dollar harm while proving at only 4%, and the insider who trades on nonpublic information is nearly invisible from inside the company.
Read the numbers with the collection bias in view. The corpus lexicon literally queries phrases like "former employee", "terminate", and "insider trading", so those volumes are partly manufactured by collection. The within-corpus rankings stand; real-world prevalence must not be read off them.
Findings
- F1 — The departing or former employee is the top proven profile. The Leaver pattern (ITM's departing-employee technique) appears in 511 of 860 cases and carries 39 of the 68 proven ones — the top of the technique table. Former or fired employees hold 30 of the 68 proven cases (44%), the largest proven block on any axis. Consequence: revoke access the day notice is given, and start elevated email and removable-media monitoring at resignation, not at the exit interview.
- F2 — Technical insiders convert to proven at the highest rate. 11 of their 58 cases end proven (19%), against 4% for executives (19 of 437) and an 8% corpus base rate. The systems they touch log them by necessity, and that machine evidence holds up in court. Consequence: ship privileged-activity logs off the systems the administrator controls, so the record survives the actor.
- F3 — Executives dominate the docket but rarely get proven. Executives and officers are named in 437 of 860 cases — 51% of the docket — yet convert at 4%. Misappropriation of Funds appears in 404 cases (29 proven), and the largest sampled dollar figure is $58.7M in alleged outflows through accounts the defendant controlled. Consequence: enforce segregation of duties on fund movement at the top of the org, and give concerns about this group a reporting path that does not run through it.
- F4 — Proven cases run through the company's own records. Email evidence carries 29 of the 68 proven cases and system or file-access logs carry 20; no externally held record class carries more than 4. Consequence: your own mail and access logs are the courtroom record — keep them on retention long enough to reconstruct a departure window months later.
- F5 — The market-informed trader is the least detectable from inside. Insider Trading appears in 202 cases (15 proven — a count inflated by construction, since the phrase is a literal collection query), and the records that catch this conduct live at the broker, not in any company log. Consequence: pre-clear trades, keep wall-crossing lists, and build the referral path to regulators instead of pretending a sensor covers it.
- F6 — The undisclosed moonlighter proves at triple the base rate. Undisclosed Concurrent Employment cases end proven 23% of the time (8 of 35) and Conflicts of Interest at 14% (14 of 98), because the proof is documentary — payroll against a second payroll, invoices against timesheets. Consequence: collect and periodically re-collect outside-employment disclosures; the attestation makes the later case mechanical.
How this was built
The corpus ledger was regenerated from the live corpus on 2026-08-28 (8,939 rows, 2,410 enriched, 860 cases with methods, 68 proven). Six analysts each worked one danger dimension and produced 24 candidate claims, every number tied to a quoted source line. Each claim then faced an adversarial verifier instructed to refute it: quotes re-checked, arithmetic recomputed, denominators audited, and the claim tested against the collection lexicon that built the corpus. 23 of 24 claims survived — 19 only after amendment, mostly to admit collection bias — and one was killed outright for comparing against a parser-default bucket.
Limits
- This corpus contains only insiders who were caught and litigated. The profile whose concealment worked, or whose employer settled quietly, is structurally absent. No prevalence here is a real-world base rate.
- The collection lexicon manufactures part of every ranking. Executive, departure, trading, and destruction volumes are all partly collection artifacts — within-corpus rankings stand, absolute volumes do not generalize.
- The proven slice is 68 cases, and 28 of them carry no role signal — role shares of the proven slice are floors. All role tags are model-read from filings, not hand-audited.
- "Proven" pools adjudicated with admitted conduct; conversion-to-proven measures provability and settlement economics, not harm.
DERIVED FROM THE INSIDER-INTEL CORPUS LEDGER · ROLES, NEVER INDIVIDUALS · TECHNIQUE NAMES FROM THE INSIDER THREAT MATRIX — ITM™ © Forscie Limited — not affiliated · LIVE NUMBERS: EVIDENCE