Which of the following is an indicator of potential insider threat?

• A. Access anomalies
• B. Excellent time management
• C. Normal performance
• D. Strong teamwork

Answer: (A)

Unusual or abnormal access patterns are a telltale sign of insider risk because they show someone operating outside the expected boundaries of their role. Access anomalies capture the moment where login times, locations, or the scope of data and systems accessed don’t align with what the person normally does. For example, someone who typically only touches lightweight applications suddenly accesses large volumes of sensitive data, or logs in at odd hours from an unfamiliar location. Those deviations can point to malicious intent, data exfiltration attempts, or a compromised account, making it the strongest indicator among the options. In contrast, excellent time management, normal performance, and strong teamwork are generally positive traits that don’t by themselves signal insider threats.