Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Enterprises Use Machine Learning for Insider Threat Detection
Transcript
- Lucas: If these conversations are useful for what you're building or running, you're probably already thinking about the biggest blind spot in security: the person sitting inside your network with legitimate access. Luna: Insider threats. They're the ones that don't set off alarms because the credentials are valid. Lucas: Exactly. And for years, the standard approach was basically: monitor logs, review them after the fact, hope you catch the anomaly. But now, machine learning is flipping that model—moving from reactive to real-time detection. And companies like Varonis and Splunk are at the center of it. Luna: If today was actually useful to you, the way these stay ad-free is listener support. Buy me a coffee dot com slash fexingo. Lucas: And that's a big part of why we can dive into the weeds on something like UEBA without a sponsor interruption. So back to the tech: the key idea is baseline what's normal for each user. Luna: Right. And that baseline is built on hundreds of features—login times, file access patterns, VPN usage, even how fast they type. Lucas: Yeah. In a recent deployment I looked at, a mid-sized financial firm—about two thousand employees—used Varonis to model every user's typical database query patterns. Within the first week, it flagged an executive's account querying tables it had never touched. Turned out to be an account takeover that would have led to a four point seven million dollar wire fraud. Luna: Wow. So the algorithm caught something a human analyst would probably miss—because the login credentials were valid. Lucas: Exactly. The machine learning model wasn't looking for 'bad'—it was looking for 'different.' And that shift in mindset is huge. Traditional signature-based detection would have missed it entirely. Luna: But I imagine the false positive rate is still a challenge. If you flag every time someone works late or accesses a new folder, your SOC team gets flooded. Lucas: That's the number one pain point. In practice, the models are tuned to reduce noise—but it's a trade-off. Too sensitive and you burn out your analysts. Too coarse and you miss real threats. Splunk's machine learning toolkit lets teams adjust thresholds based on role. A developer accessing code repos at 2 a.m. is normal. A finance manager doing the same? That's an alert. Luna: So context is everything. You need to label user roles and behaviors upfront. That's a lot of data preparation. Lucas: It is. And that's actually where most deployments get stuck. Companies underestimate the time it takes to clean historical logs and define what 'normal' means for each department. But once it's running, the payoff is real. The same financial firm I mentioned—they went from detecting insider threats in an average of forty-seven days to within two hours of the anomalous behavior. Luna: Forty-seven days to two hours. That's not incremental—that's a step change. Lucas: Absolutely. And it's not just about speed. It's about catching the subtle stuff. Data exfiltration often happens in small bursts over weeks—an employee downloading a few extra files each day. A human reviewing logs might never connect the dots. But a behavioral model can spot the gradual shift. Luna: There was a case from a few years ago where a disgruntled system admin at a tech company copied source code before leaving. The logs showed he accessed the repo more frequently in his last two weeks. A UEBA tool would have flagged that pattern. Lucas: Right. And that's the kind of scenario where ML shines—not just on the clear-cut, but on the statistical drift. The models are constantly updating baselines. If your behavior changes gradually, it adapts. But if it jumps, that's the signal. Luna: So the machine learning is unsupervised for the most part? Or do you need labeled data for training? Lucas: It's a mix. The anomaly detection piece is typically unsupervised—it learns what's normal without being told what an attack looks like. But to reduce false positives, teams often layer on supervised models trained on past incidents. That way, the system can say: 'this anomaly matches the pattern of previous account takeovers.' Luna: That makes sense. So you need a good incident history to train those supervised models. Smaller companies might not have that. Lucas: Exactly. And that's where vendors help by providing cross-industry threat models. Varonis, for example, has a library of attack behaviors based on thousands of deployments. You can start with those and then tune. But it's never set-and-forget. Luna: And what about privacy concerns? Employees might not love being monitored at that granular level. Lucas: It's a legitimate tension. Most companies scope monitoring to business systems and communicate it clearly. The best approach is to be transparent: 'We monitor for unusual access to protect company data and your accounts.' And in regulated industries, it's often mandated anyway. Luna: So what's the next frontier for insider threat detection? Where is the technology heading? Lucas: Two trends I'm watching. First, integrating with identity threat detection and response platforms—tying user behavior analytics directly into automated response, like blocking access or requiring step-up authentication in real time. Second, using natural language processing to analyze email and chat for intent signals—not just who you message, but the sentiment and urgency. Luna: That's getting into some pretty sensitive territory. But I can see how it would catch a departing employee emailing files to a personal account. Lucas: Exactly. And the tools are already there. Microsoft's insider risk management features, for instance, flag patterns like mass file downloads or unusual sharing links. It's not just ML on network logs anymore—it's about connecting all the signals. Luna: So for a company just starting this journey, what's the first step? Should they buy a platform or build their own models? Lucas: Unless you have a dedicated data science team, buy. The platforms from Varonis, Splunk, and Microsoft are mature. Start with a pilot on a high-risk group—say, finance or IT—and measure the reduction in detection time. Then expand. Luna: And make sure you have the data pipeline in place first. Garbage in, garbage out. Lucas: Absolutely. The algorithm is only as good as the logs you feed it. But when it works, it's one of the most effective defenses against the one threat you can't firewall away: the user. Luna: Because at the end of the day, the insider already has the keys. The question is whether they're using them for the right reasons. Lucas: And machine learning is getting better at answering that question in real time. That's where the industry is headed—and it's only going to get more precise.