What were the biggest considerations for you when evaluating solutions for insider threat detection?

Security & GRCThreat & Vulnerability Management
3.2k viewscircle icon4 Comments
Sort by:
Chief Information Security Officer in Healthcare and Biotech2 years ago

Couple of points - 
1. Easy of business 
2. Good employee experience
3. Data classification 
4. Granular level visibility

Lightbulb on1
CISO2 years ago

First was defining the assets and actions that were important and what we wanted to do -- observe, alert, act, etc. From those requirements, we evaluated solutions to see how effective they would be for what we needed.

CISO in Software2 years ago

Scale and performance.

Director of Network Transformation2 years ago

How do I protect my sensitive data, how do I protect myself from IT folks with full admin rights and my offboarding process for employees leaving the company.  Been burned by all of those in the past!

Content you might like

Do you have a security behavior and culture program (SBCP)?

Yes23%

We’re currently developing an SBCP27%

We’re currently exploring SBCPs27%

No, but I expect that will change13%

No, and I don’t expect that to change6%

Other (please specify)1%

View Results

As part of our NYSE IPO prep, we’re debating how to communicate our system hardening efforts in regulatory disclosures (e.g., SEC Form 20-F, SFC).

Would you recommend sharing % compliance (e.g., “85% CIS Tier 2”) or sticking to qualitative descriptions of how we identify and mitigate risks? Also, do SFC/ISO 27001 expectations require full ISMS integration, or is a % model acceptable?

We’re preparing for an IPO on the NYSE as a Foreign Private Issuer and evaluating CIS Benchmarks to measure OS and database hardening.

Our proposed tiers:
• Tier 1 (70–80%) baseline
• Tier 2 (85–90%) for sensitive data
• Tier 3 (95–100%) for mission-critical systems

Is 80% compliance defensible for IPO due diligence with SEC or SFC? Should Tier 3 be considered mandatory for critical systems? And can compensating controls (e.g., PAM, microsegmentation) offset gaps in legacy environments?

Which pitfalls—model bias, false positives/negatives, data quality, regulatory constraints—often impede AI-based security tools, and how can they be mitigated in a financial-services context?

Read More Comments

Do you think software companies will ever prioritize security needs over customer experience (CX)?

Yes49%

No40%

Unsure9%

Other (comment below)

View Results