Human Resource Detection of Cybersecurity Risks Using Public Insider Threat Data

Insider threats represent one of the most damaging and difficult-to-detect cybersecurity risks, as perpetrators possess legitimate access to organizational systems. While most defense mechanisms focus on external attacks, monitoring employee behavior provides a crucial opportunity for proactive prevention. This research aims to explore the use of publicly available insider threat datasets to build Human Resource (HR) behavioral profiles as an early warning mechanism for cybersecurity risks. The methodology encompasses public incident data acquisition and the application of statistical and machine learning approaches—including Generalized Additive Models (GAM), Long Short-Term Memory (LSTM), and Gradient Boosting Machine (GBM)—to analyze behavioral anomalies and indicators. The findings identify various significant early warning signals, such as policy violations, job searching activities, attendance changes (e.g., sudden overtime), and communication anomalies. Although the analysis indicates that the relationship between general HR metrics and security incidents is sometimes inconsistent, targeted behavioral profiling still provides valuable insights for prioritizing investigations. This study concludes that structured integration and collaboration between HR departments and IT security teams are essential to mitigate insider risks, the implementation of which must be balanced with compliance to data privacy regulations (such as GDPR) and ethical considerations regarding employee surveillance.