Software Engineering Institute

Organizations struggle to implement effective insider risk management programs because insiders present unique challenges to cybersecurity. Traditional insider risk practices focus on extrinsic controls that pressure employees into compliance, which, taken too far, can exacerbate the insider threat. Positive deterrence practices complement traditional practices by fostering employees’ intrinsic motivation to act in the interests of the organization and build their sense of commitment to the organization, the work, and their co-workers. SEI research provides actionable, evidence-based guidance to apply positive deterrence as a complement to traditional practices in a way that provides a better balance for organizations’ insider threat programs.