For a decade, insider threat meant people. Some were intentional: stealing data, sabotage.Most were accidental: a malicious download, a confidential file sent to a personal email.
There is now a second population of insiders, and it is growing faster than the first. AIagents have permissions, they act on their own, and they can be misused orcompromised.
With people, we at least knew what to collect. The activity was logged, and the hard partwas the analytics. That is the problem UEBA set out to solve, and it partly did.
Agents break both halves
Agents make the data problem and the analytics problem harder at the same time.
Intent is hard to trace. An agent calls sub-agents, and those spin up their own activity.The instruction that started the chain can be several steps removed from the action thatmatters.
Telemetry is patchy. Enterprise AI tools expose some events. ShadowAI exposes almostnone without something on the host.
Baselines don't fit. Most SIEM and UEBA tools baseline users, hosts and IPs. An agent is astrange combination of all three: it carries a user's permissions, runs on a host and talks tothe network like a service.
The developer, the agent, or a compromise?
Picture a coding agent running with a developer's permissions. It pulls a repository andsends it to an external API.
Three explanations fit the same log line. The developer asked for it. The agent is doing itsjob, perhaps calling a hosted model. Or the agent has been compromised, for example byinstructions hidden in a file it read. Most tools today cannot tell you which.
What separates them is context that no single tool holds:
Each signal is weak alone. A developer who has given notice, an agent reachingrepositories outside its usual scope, and an unsanctioned destination are a toxiccombination. You only see it when human and agent behavior sit in the same model.
AIDR is necessary, and it is half the answer
The industry's answer so far is AIDR, AI detection and response: watch the agents, catchthe prompt injection, stop the unsafe action. That is necessary.
But it treats agents as a new silo, sitting next to the UEBA silo we built for people. Anagent's behavior only means something when you can tie it to the user who launched itand the host it ran on. UEBA and AIDR are two halves of the same question.
Where the signals come from
The two kinds of insider leave their traces in different places, which is why they ended upin different tools.
Human activity reaches the SIEM or data lake through EDR, firewalls and proxies. Agentactivity is visible through AI security tools and gateways, and for shadowAI often onlyfrom the host.
Three things have to change
1. The definition of an insider. It has to cover virtual users as well as human ones, underone behavioral model. In practice, every agent needs what every employee already has: anidentity, an owner, a set of permissions and a baseline of normal behavior.
2. The frameworks. MITRE ATT&CK describes what adversaries do to systems. MITREATLAS describes what happens to and through AI. For human insiders, Forscie's InsiderThreat Matrix plays the same role. You need all of them mapped to the same activity, sothat an agent's tool call and a user's file download can be read as steps in one story.
3. The chain of accountability. Every agent and sub-agent action has to tie back to theuser who launched it and the host it ran on. Without that link there is no intent to analyze,only activity.
Enterprise Behavior Analytics
An advisor of ours calls this Enterprise BehaviorAnalytics, and I think the name fits. Thequestion is no longer what your users are doing. It is what everything acting on yourbehalf is doing.
This is what we have been building at AiStrike. We treat AI-agent activity, meaningprompts, tool calls, API calls and data access, as security telemetry alongside user andhost activity. Events are classified against MITRE ATLAS and the Insider Threat Matrix.Related anomalies across a user and the agents acting for them are stitched into one case,not scattered across two tools.
We built it with our design partners, and we are making it available to AiStrike customers.
Data sheet: [LINK]
Related: Agents watching agents and Insider threat has outgrown legacy UEBA
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.avif)
.svg)
.webp){kind=icon}