Paper Proposes Time-Decay Model for Insider Risk Indicators
Summary
The paper reviews research on how insider-risk indicators lose relevance over time and proposes exponential decay levels for risk models, while calling for further validation.
Key points
- The paper argues that insider-risk indicators should not all be treated as equally relevant indefinitely; their decay rates vary by indicator type.
- One cited survey collected judgments from 25 experts across 26 hypothetical cases over four months; personal predisposition indicators generally showed less decay than other types.
- A second cited study had 12 analysts rate decay for 265 indicators in the SOFIT taxonomy; analysts rarely assigned the highest decay rate.
- The proposed SOFIT2.0 approach uses exponential decay with three levels: none (α = 0), slow (α = 0.004), and moderate (α = 0.012).
- The paper says incorporating decay could reduce false positives and wasted analyst effort, while warning that misidentifying employees may erode trust.
- The author calls for further studies to validate the decay model and parameters and examine repeated indicators and protective factors.
Article Details
- Publisher
- IEEE Engineering Management Review
- Report Period
- Submitted 2025-07-25; revised 2025-10-27 and 2025-12-29; accepted for publication in 2026
- Scope
- Insider risk indicator decay and its modeling in insider risk management
- Sample Size
- Two expert-judgment studies: 25 respondents rated 26 hypothetical cases over four months; 12 operational analysts rated decay for 265 PRIs.
- Key Statistics
- In the operational analyst study, more than half of technical indicators were assigned a decay rate with a half-life of one or two months; 9% were considered not to decay.
- In that study, 69% of personal predispositions were assigned zero decay.
- The proposed moderate decay rate (α = 0.012) has an approximate two-month half-life; the slow rate (α = 0.004) has an approximate six-month half-life.
- The cited 2024 Insider Threat Report found that 83% of surveyed organizations experienced at least one insider incident in 2024.
- The cited report states that 12% of organizations use well-established predictive insider risk assessment models.
- Recommendations
- Incorporate indicator decay rates into insider risk assessment models rather than treating all indicators as static.
- Conduct further expert elicitation to validate the proposed exponential decay function and its three decay levels.
- Study how later occurrences of the same or different indicators affect indicators already undergoing decay, and further examine the impact of protective factors.