How Does Behavioral Analytics Detect Insider Risk?

TL;DR

Behavioral analytics can reduce insider risk by unifying communications, transactions, and physical security records, then modeling human behavior over time. RedOwl's platform helps compliance and security teams search, monitor, and explore their archives, with a human reviewing potential issues and false positives rather than software making final judgments.

Transcript

Red Owl Analytics with the tagline, "Behavioral intelligence for insider threat." Please join me in welcoming up Guy Filippelli. Hi, I'm Guy Filippelli. I'm the president of Red Owl Analytics. Thanks to Brian Godsey, one of our employees, for that song, if you caught it. Um, I want you to turn your thoughts away from networks for a second, and I wa... Read More

Key Insights

• RedOwl's platform is designed to bring communications, transactions, physical security records, and other disparate information into one place so compliance and security officers can investigate questions without repeatedly assembling data through employees, consultants, and lawyers.
• The platform's analytics classify incoming data and statistically model human behavior over time, allowing business users to examine patterns across multiple information streams rather than treating every archive or event as an isolated source of evidence.
• The platform's user interfaces are built for searching, monitoring, and exploring organizational archives, giving compliance and security professionals direct control over investigations and helping them ask the questions they actually need to answer.
• The immediate economic benefit is reduced spending on human labor used to collect, reconcile, and review fragmented information, while the longer-term objective is to reduce catastrophic risk by discovering and discouraging damaging internal behavior.
• The initial target market is financial services, including both small and large institutions, because compliance teams face costly and complicated work when answering regulatory inquiries or investigating behavior across disconnected systems.
• The broader market is any organization exposed to human risk, including risks involving regulation, corruption, intellectual property theft, reputational harm, or damage to the company's balance sheet.
• A significant customer benefit is faster exoneration of good employees, since compliance and security teams may spend more effort explaining legitimate conduct than identifying genuinely harmful behavior within organizational archives.
• Human review is an essential part of the system because false positives are expected during investigations. The software is intended to reduce noise and empower analysts, not replace them or independently determine whether an employee's behavior is right or wrong.

Questions & Answers

Q: How does behavioral analytics help detect insider risk?

Behavioral analytics helps detect insider risk by combining multiple organizational data streams, classifying the incoming information, and statistically modeling human behavior over time. Investigators can then search, monitor, and explore the resulting archive for relevant patterns. The approach supports human judgment by reducing noise and organizing evidence, rather than allowing a computer to independently label behavior as right or wrong.

Q: What types of data does RedOwl's platform combine?

RedOwl's platform can combine communication streams, transactions, physical security data, and other organizational records. It maps varied sources into a simplified model centered on a small set of fields, including the originator, timestamp, participants, context, topic, and content. Once normalized, the information can be classified, analyzed, searched, monitored, and explored through a common set of interfaces.

Q: How does RedOwl simplify integration across different data sets?

RedOwl simplifies integration by concentrating on roughly ten common fields rather than preserving every source in a completely separate structure. The fields mentioned include the originator, timestamp, participants, context, topic, and content. By fitting different records into this shared model, the platform can process varied streams together and give compliance or security users a consistent way to investigate them.

Q: Why can unified archives reduce compliance costs?

Unified archives can reduce compliance costs because investigators otherwise depend on employees, consultants, and lawyers to gather disparate records from multiple locations whenever they face a regulatory inquiry or need to answer a question. Bringing those records into one model reduces this fragmented labor. It also gives compliance officers more direct control over searching and explaining the information already held by their organization.

Q: How can behavioral intelligence help exonerate employees?

Behavioral intelligence can help exonerate employees by making relevant records easier to locate, connect, and interpret during an investigation. RedOwl found that customers gained value not only from hunting harmful behavior, but also from clearing good people more quickly. The company concluded that compliance and security teams may spend more effort explaining legitimate activity than finding misconduct, making faster exoneration an important benefit.

Q: How does RedOwl handle false positives?

RedOwl handles false positives by keeping a human involved in the investigative process. False positives are treated as a normal part of compliance and security work, not as proof that automated analysis should make final decisions. The platform aims to reduce noise, organize evidence, and help users investigate alerts, while leaving judgments about whether conduct is acceptable or harmful to qualified people.

Q: Which industries and risks can use behavioral intelligence?

RedOwl begins with small and large financial services institutions, where compliance investigations involve complicated regulatory and data-management demands. The company also sees applications wherever human actions can harm an organization's reputation or balance sheet. Examples named in the presentation include regulation, corruption, intellectual property theft, and other forms of human risk that can be examined through internal organizational records.

Q: What are the three main functions of RedOwl's platform?

RedOwl's platform performs three main functions. First, it brings different data streams together in one simplified model. Second, it applies mathematical and enrichment processing to classify incoming information and statistically model human behavior over time. Third, it provides user interfaces through which compliance and security professionals can search, monitor, and explore their archives while retaining control over investigative decisions.

Summary & Key Takeaways

• RedOwl Analytics presents a software platform for behavioral intelligence in compliance and security. It replaces a fragmented process involving employees, consultants, lawyers, and disconnected records with a unified model that combines communication streams, transactions, and physical security data for easier analysis and investigation.

• The platform performs three main functions: integrating different data streams, applying mathematical and enrichment processing to classify information and model human behavior over time, and providing interfaces for searching, monitoring, and exploring records. Its purpose is to empower investigators, not automatically decide whether conduct is right or wrong.

• RedOwl initially targets small and large financial services institutions, while identifying broader applications involving regulation, corruption, intellectual property theft, and other human risks. The company reports that customers also use the platform to exonerate good employees faster, which may reduce the substantial effort spent explaining legitimate behavior.