2. ITP Maturity Model Survey 2018
150 Information Security Professionals
August 2018

3. Insider Threat Program Maturity Model
No ITP
Unaware of risks
Aware of risks
IT responsibility
Focus on tech
Necessary depts.
Formal program
Early threat ID
Policies in place
Org-wide monitoring
Dynamic, responsive ITP
Agile

4. 9 Aspects of the ITP Maturity Model
Goals & Objectives
Awareness
Governance
Risk Assessment
Policies
Monitoring
Process
Intelligence Sources
Communications & Training

5. Benchmarking ITP Maturity

6. Key Findings
Mid-market organizations have the greatest amount of work to do. With a majority of these organizations given little to no budget and the most basic of C-level support, most insider threat programs are reactive in nature, allowing threats to occur before IT teams even respond.

7. Key Findings
The majority of organizations today have no formal team in place to establish policy and process, and to mature the program in response to both perceived and experienced threats.

8. Key Findings Organization size had no impact on the maturity of the program in place. Other than the shift from a lack of a program in smaller organizations to the presence of some kind of program in larger ones, the levels of program maturity did not increase with organization size.

9. More Key Findings Organizational support Budgetary expenditures
Tool Augmentation

10. Key Finding
Privacy was a greater concern for less mature programs and less of a concern for mature programs.

11. Building a Mature Insider Threat Program
Obtain executive buy-in.
Consult with legal counsel early and frequently.
Define the process for how to respond to an insider threat situation.
Create an inventory of critical data to define the focus of the ITP.
View internal threats holistically as you would external threats.
Identify existing technologies which may augment the ITP.
Establish clear acceptable use policies.
Identify resources to assist HR in employee screening.
Invest in the correct tools to identify, prevent and mitigate insider threats.
Include ITP communication as part of the onboarding and annual training processes.

12. Veriato.com
The Veriato mission is to help customers protect their most valuable assets, reduce their risk, and gain unparalleled visibility into their operations with advanced machine learning and data analytics insider threat protection solutions.
Our solutions are deployed in 110+ countries
Over 3,000 enterprises, & thousands of SMBs have placed their trust in our solutions 8
Out of
Top 10 7
Out of
Top 10 6
Out of
Top 10
Technology
Financial
Health