<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-insider-threat-awareness
description: >-
  Perform insider threat awareness training covering behavioral indicators,
  reporting mechanisms, data loss prevention concepts, privilege abuse scenarios,
  and organizational culture approaches aligned with NITTF and CISA guidance.
domain: cybersecurity
subdomain: security-awareness
tags:
  - insider-threat
  - behavioral-indicators
  - dlp
  - reporting
  - nittf
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Performing Insider Threat Awareness

## Overview

Insider threat awareness equips employees to recognize behavioral indicators
of potential insider threats without creating a surveillance culture. This skill
covers indicator recognition training, safe reporting channels, DLP awareness,
privilege management education, and culture-positive program design aligned with
NITTF and CISA insider threat frameworks.

## Prerequisites

| Requirement | Install |
|---|---|
| Framework | NITTF Insider Threat Program Maturity Framework |
| Reporting system | Anonymous tip line, EthicsPoint, or equivalent |
| DLP tooling | Microsoft Purview, Symantec DLP, or equivalent |

## Commands

| Command | Description |
|---|---|
| `node agent.js indicators --category behavioral --format training` | Generate behavioral indicator training materials |
| `node agent.js scenarios --risk-level high --department finance` | Build department-specific insider threat scenarios |
| `node agent.js reporting --channels anonymous,manager,security` | Design insider threat reporting workflow |
| `node agent.js assess --maturity current --framework nittf` | Assess program maturity against NITTF framework |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js indicators --category behavioral --format training
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js scenarios --risk-level high --department finance
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js reporting --channels anonymous,manager,security
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js assess --maturity current --framework nittf
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
