How Should AI Predict Employee Security Risk?

TL;DR

Predictive security should guide constructive, low-impact protections rather than automatically punish employees. Because even a prediction made with ninety-nine percent certainty can be wrong one time in a hundred, organizations should examine legal risks, exclude protected characteristics, consider the employee’s perspective, and use measures such as conditional encryption that protect data without preventing people from doing their jobs.

Transcript

Hi, my name is Dr. Richard Ford, and I'm the Chief Scientist over here at Forcepoint. I wanna talk today about something that I think is really interesting, and that's how AI is gonna change how we deal with people, especially in the security world. The title of this talk is Minority Report, um, because I think most of you will be very familiar wit... Read More

Key Insights

• Predictive analytics estimates what is likely to happen rather than revealing a certain future. Even a prediction with ninety-nine percent surety remains wrong one time in a hundred, so organizations must not treat an employee’s risk score as proof that harmful conduct will occur.
• Descriptive analytics identifies events already present in security data by reconstructing evidence left behind. Predictive analytics moves beyond that past or present view by estimating future outcomes, such as which person may leave a company, become an insider threat, or encounter malware.
• Employee departure is a normal part of organizational life, but it creates specific security and retention risks. A prediction that someone may leave can support a positive conversation about dissatisfaction, working conditions, fulfillment, or the underlying reasons that could influence that employee’s decision.
• Restricting an employee because of a prediction can produce the behavior an organization hoped to prevent. Removing access from someone loosely identified as a flight risk may frustrate or alienate that person, potentially turning a weak likelihood of departure into a much stronger one.
• Human predictions have greater consequences than automated decisions about computer traffic. Blocking a few packets because a website may be harmful is fundamentally different from blocking a person’s ability to perform a job, so employee-focused systems require more cautious and humane responses.
• Predictive monitoring can feel intrusive because generalized patterns are applied to unique individuals. The transcript compares this discomfort to receiving baby-product advertising based on buying patterns, age, and demographics before a person expects a vendor to know about a pregnancy.
• Protected characteristics must not determine decisions made through employee prediction. Organizations need to ensure that models do not incorporate age, race, or disability, including indirectly through second-order effects in the data, and must carefully examine the legal issues surrounding insider-threat programs.
• Risk-adaptive protection can secure critical assets without automatically punishing a predicted high-risk employee. Encrypting sensitive data when someone attempts to copy it to a USB drive offers a constructive mitigation that preserves normal access while reducing the potential consequences of unauthorized removal.

Questions & Answers

Q: What is predictive analytics in cybersecurity?

Predictive analytics in cybersecurity uses available data to estimate what is likely to happen in the future. It can assess possibilities such as whether a website may harm a computer, whether an employee may leave, who might become an insider threat, or who may encounter malware. Unlike descriptive analytics, it does not merely identify evidence of an event that has already happened.

Q: How does predictive analytics differ from descriptive analytics?

Descriptive analytics identifies conditions or security events that are already present in collected data. It can reconstruct an event from the pieces or “shrapnel” left behind even when nobody observed the event directly. Predictive analytics looks ahead instead, estimating which future event is likely. Its result is a probability that supports decisions, not a guarantee that the predicted event will occur.

Q: Why should predictive security systems keep humans in the loop?

Humans should remain involved because a prediction about a person can affect employment, access, trust, and the ability to perform a job. Even a highly confident model can be wrong, and an employee should not be reduced to a number. Human review helps organizations consider context, legal concerns, employee welfare, and whether a proposed response is constructive and proportionate.

Q: What legal risks can arise from predicting employee behavior?

Employee prediction can create legal problems when a model or decision uses protected characteristics such as age, race, or disability. These characteristics may enter a model directly or appear through second-order effects in other data. Organizations therefore need to examine how models are built and applied, think carefully about the legal issues surrounding insider-threat programs, and ensure decisions protect employees rather than harm them.

Q: How should a company respond when an employee is predicted to leave?

A company can use a flight-risk prediction as a reason for constructive engagement rather than punishment. If the person is important to the organization, managers could ask whether the employee is unhappy, explore the underlying problem, and improve working conditions or fulfillment. Immediately restricting sensitive access may harm someone based on an uncertain prediction and could make that employee more likely to leave.

Q: Why can predictive employee monitoring feel intrusive?

Predictive monitoring can feel intrusive because it infers personal conditions or future behavior from patterns an individual may not realize are being analyzed. The transcript gives the example of baby-product advertising generated from historic purchases, age, and demographics. Although such marketing may benefit a brand and customer, unexpected knowledge about a pregnancy can feel creepy, and workplace predictions can create a similar Big Brother concern.

Q: What is a constructive alternative to blocking a high-risk employee’s access?

A company can preserve an employee’s normal access while applying protection at the moment a risky action occurs. For example, if an employee predicted to be a flight risk tries to copy sensitive information to a USB drive, the system could encrypt the data. This limits potential loss without preventing the person from doing the job or punishing them if the prediction is wrong.

Q: What questions should organizations ask before acting on an AI prediction?

Organizations should ask what they should do for the employee’s benefit, not merely what technology allows or what is legally possible. They should consider whether the prediction is uncertain, whether protected characteristics influenced it, how an action could harm the person, and whether a constructive mitigation can protect critical assets. A prediction is useful only when it supports an appropriate and effective response.

Summary & Key Takeaways

• Artificial intelligence can estimate which employees may leave an organization, become insider threats, or encounter malware, much as advertising systems estimate who may click or buy. These predictions offer a glimpse of likely future behavior, but they are probabilities rather than certainties and require careful interpretation before an organization acts on them.

• Human-focused predictive security requires organizations to consider legal and ethical consequences, especially when employee data may directly or indirectly reflect protected characteristics such as age, race, or disability. Leaders should move beyond asking what technology permits or what is legal and instead ask what action is right for employees.

• Predictions create value only when organizations can translate them into constructive protections. Rather than restricting a predicted flight-risk employee’s access and potentially harming that person, a company could encrypt sensitive data when it is copied to a USB drive. This risk-adaptive approach protects assets without automatically penalizing the employee involved.