Which of the following would indicate an insider threat?

• A. Access anomalies
• B. Strong teamwork
• C. Regular attendance
• D. Excellent punctuality

Answer: (A)

Unusual or unexpected access patterns signal insider threat because someone with legitimate credentials is using them in a way that doesn’t fit their role or normal work habits. This can include logging in at odd hours, accessing systems or data they don’t need for their job, or from locations that are out of the ordinary, and even downloading large amounts of data. These deviations from the user’s usual behavior suggest potential misuse or data exfiltration. Positive workplace behaviors like strong teamwork, regular attendance, and excellent punctuality reflect reliability and cooperation, not misuse of access, so they don’t indicate an insider threat.