Notes from
the work.
How insider theft actually happens, what evidence survives afterward, and what to change before the next resignation. Written by the people who do the investigations.
Two school district employees in Texas were arrested this week over the alleged deletion of police records. Nothing left the building. Insider programs are built to watch the door, and the harder case is the one where the evidence simply stops existing. Here is how that case is investigated, and what to preserve before anyone touches anything.
A quantitative trader is accused of using two years of legitimate access to build a competing firm on his employer's code, then telling his own staff to delete the history. The case is a clean lesson in why "who accessed the repository" is the wrong first question, and what an investigation has to reconstruct instead.
See what coverage would have shown.
Bring the systems you run and the departures you are worried about.
How it works, end to end →