Insider Threat and Workplace Security Reporting
Teach employees to recognize and report concerning behavior, data misuse, coercion, and physical-security issues — without making accusations or assumptions. Covers accidental mistakes, negligent behavior, compromised employees, and malicious actors, with respectful reporting that balances vigilance and fairness.
What you'll learn
- Understand insider threat the way it actually appears — overwhelmingly accidental and negligent behavior, sometimes compromised accounts and devices, rarely malicious — and why framing matters for both effective reporting and a respectful workplace.
- Recognize common insider-risk indicators across digital and physical spaces: unusual data access or export, after-hours activity on sensitive systems, tailgating, unescorted visitors in restricted areas, lost badges, and behavior changes under personal or financial stress.
- Protect physical and digital access through the small daily habits that matter: locking devices when stepping away, challenging unfamiliar faces in restricted areas, securing printed sensitive material, and never sharing badges or passwords.
- Report concerns through your organization's proper channels — security, HR, ethics hotline, or your manager — using facts and observations rather than conclusions or accusations.
- Avoid confrontation, direct investigation, and public speculation; these inflame the situation, destroy evidence, and expose the reporter and the organization to legal risk.
- Trust the anti-retaliation protections and the fairness of the process — your job is to raise the concern, not to decide what it means or who is responsible.
Requirements
- A workstation, laptop, tablet, or phone with a modern browser.
- Audio or captions enabled so you can follow the narrated video for each module.
- No prior security training required — this course is designed for every employee, including managers, security team members, HR staff, and front-line administrative personnel.
Course content
7 chapters · 6 lectures · 30m 30s total
Module 1 — What Insider Threat Means
What insider threat actually looks like in a working organization — overwhelmingly accidental and negligent behavior, sometimes a compromised account or device, and only rarely a deliberate bad actor. Why the framing matters: for the way you spot problems, for the way you report them, and for the respectful workplace that makes a reporting culture work in the first place.
1 item
Module 1 — What Insider Threat Means
What insider threat actually looks like in a working organization — overwhelmingly accidental and negligent behavior, sometimes a compromised account or device, and only rarely a deliberate bad actor. Why the framing matters: for the way you spot problems, for the way you report them, and for the respectful workplace that makes a reporting culture work in the first place.
-
What Insider Threat Means Free preview5 minutes
Module 2 — Accidental and Compromised Insiders
The two most common insider-risk categories in practice: ordinary people making ordinary mistakes, and ordinary people whose accounts or devices have been taken over. How to spot them without jumping to conclusions, how to tell 'something looks different' from 'that person is bad', and why the right first instinct is almost always help and report rather than accuse.
1 item
Module 2 — Accidental and Compromised Insiders
The two most common insider-risk categories in practice: ordinary people making ordinary mistakes, and ordinary people whose accounts or devices have been taken over. How to spot them without jumping to conclusions, how to tell 'something looks different' from 'that person is bad', and why the right first instinct is almost always help and report rather than accuse.
-
Accidental and Compromised Insiders5 minutes
Module 3 — Physical Access and Visitors
The physical-security habits that quietly do most of the work: badging in without letting the next person tailgate, challenging unfamiliar faces in restricted areas, locking devices when you step away, picking up lost badges and routing them, and never shortcutting the visitor sign-in process — even for someone who seems like they obviously belong.
1 item
Module 3 — Physical Access and Visitors
The physical-security habits that quietly do most of the work: badging in without letting the next person tailgate, challenging unfamiliar faces in restricted areas, locking devices when you step away, picking up lost badges and routing them, and never shortcutting the visitor sign-in process — even for someone who seems like they obviously belong.
-
Physical Access and Visitors5 minutes
Module 4 — Data Misuse and Unusual Behavior
The digital signals that security teams actually care about — unusual data movement, after-hours activity on sensitive systems, access requests outside normal job scope, and the social-engineering patterns like 'can you log in for me, my account keeps getting locked'. How to spot them, how to describe them in facts, and why your job is to pass the observation on rather than to work out what it means.
1 item
Module 4 — Data Misuse and Unusual Behavior
The digital signals that security teams actually care about — unusual data movement, after-hours activity on sensitive systems, access requests outside normal job scope, and the social-engineering patterns like 'can you log in for me, my account keeps getting locked'. How to spot them, how to describe them in facts, and why your job is to pass the observation on rather than to work out what it means.
-
Data Misuse and Unusual Behavior5 minutes
Module 5 — Report Without Accusing
The reporting habit that makes the whole program work: describe what you observed, through the proper channel, without accusation and without investigation of your own. What to include, what to leave out, who to tell, and the three things to never do — do not confront, do not post publicly, do not try to collect evidence yourself.
1 item
Module 5 — Report Without Accusing
The reporting habit that makes the whole program work: describe what you observed, through the proper channel, without accusation and without investigation of your own. What to include, what to leave out, who to tell, and the three things to never do — do not confront, do not post publicly, do not try to collect evidence yourself.
-
Report Without Accusing5 minutes
Module 6 — Protecting a Respectful Workplace
The other half of a healthy reporting culture: treating the person reported about fairly, trusting the anti-retaliation protections if you are the reporter, and never using the security channel as a way to settle disagreements. Why due process, confidentiality, and the presumption of innocence are the things that make reporting work in the first place.
1 item
Module 6 — Protecting a Respectful Workplace
The other half of a healthy reporting culture: treating the person reported about fairly, trusting the anti-retaliation protections if you are the reporter, and never using the security channel as a way to settle disagreements. Why due process, confidentiality, and the presumption of innocence are the things that make reporting work in the first place.
-
Protecting a Respectful Workplace5 minutes 30 seconds
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
1 item
Final Assessment
A 12-question scenario-based quiz covering all six modules. You need 80% or higher to pass and earn your completion certificate. You may retake the assessment as many times as needed.
-
Final Assessment — Insider Threat and Workplace Security Reporting