Why Insider Risk Detection Needs Context Beyond User Anomalies
Summary
The sponsored article argues that insider-risk detection needs user-specific context, not isolated anomalies, and presents Ent’s endpoint AI as a way to distinguish malicious activity, compromise and mistakes. It describes two anonymized customer investigations.
Key points
- The article describes North Korean IT worker schemes involving stolen identities, forged documents and remote work setups; it cites a 2024 UN report estimating 3,000 workers abroad and $250 million to $600 million in annual revenue.
- It says North Korean-linked campaigns target developers through fabricated professional profiles and job opportunities, then direct them to install malware-seeded or compromised packages.
- Examples such as moving customer data to a personal drive or pasting credentials into a public AI tool can resemble routine work, making isolated rule-based alerts hard to interpret.
- Ent says its approach correlates endpoint activity sequences with individual roles and behavioral baselines to distinguish hostile actions, compromised users and mistakes.
- In one anonymized customer investigation, Ent reports that KVM activity, Teams credential transfers and role-inconsistent file access revealed an external handoff; the investigation concluded in five days.
- In another vendor-reported case, extended Zoom and AnyDesk sessions preceded external access to sensitive Google Drive files; the article characterizes the pattern as over-employment.
- Ent says its system can block hostile actions and provide real-time guidance when an employee makes a mistake; these capabilities are presented as vendor claims.
Article Details
- Topic
- Insider risk and intent-aware AI endpoint security, including malicious and inadvertent insider activity
Products
AnyDeskEnt detected employees granting extended remote access sessions using legitimate tools such as Zoom and AnyDesk. Sessions ran for up to eight hours at a stretch. The activity that followed led to external partiesEntEnt was built around this model. It follows what people and agents do on the endpoint as one connected sequence and understands the intent behind it, so it can see whether behavior stays within the bounds of the user'sGoogle Driveup to eight hours at a stretch. The activity that followed led to external parties accessing sensitive Google Drive files. The pattern was consistent with over-employment: employees using outside contractors to performMicrosoft Teamsraised no alarms, as KVM switches often have a legitimate business purpose. What followed did. Microsoft Teams audio was routed away from local speakers and through the KVM device. Teams messages containedZoomcase, Ent detected employees granting extended remote access sessions using legitimate tools such as Zoom and AnyDesk. Sessions ran for up to eight hours at a stretch. The activity that followed led to external
Countries
North KoreaA 2024 United Nations Panel of Experts report identified the IT sector as a key source of revenue for North Korea, estimating roughly 3,000 North Korean IT workers abroad and another 1,000 inside the country,United StatesAccording to U.S. government investigations, North Korean state-sponsored IT worker schemes have built a sophisticated infrastructure for placing fraudulent workers inside American and European companies, including