About Insider Threat AISecOps Agent
The Insider Threat AISecOps Agent is part of the Netskope AISecOps portfolio. Where the DLP AISecOps Agent monitors data leaving your organization, the Insider Threat Agent monitors user behavior and risk.
The agent runs on a daily schedule and automatically ranks users by risk level, queues investigations for the highest-risk users, and generates a per-user report that includes a risk verdict, behavioral anomalies, data-loss exposure, malware indicators, an activity timeline, and recommended actions. Results are surfaced in a single page, eliminating the need to correlate data across multiple dashboards.
How it works
TheInsider Threat AISecOps Agent runs as a daily scheduled job. Each run has three phases:
1. Select the riskiest users The agent ranks all users in your tenant by their User Confidence Index (UCI) — Netskope’s per-user risk score, where a lower score means higher risk. By default, the top 20 users are automatically added to the watchlist and flagged for investigation. This number is configurable from 1 to 1,000. This daily selection is not cumulative, a subsequent run may replace some or all of the previously auto-selected users.
In addition to auto-selected users, any members of configured watchlist groups (such as Executives or Finance) and any manually added users are also queued for investigation each day.
2. Investigate each user For each user on the watchlist, the agent collects a broad picture of recent activity — behavioral anomalies, DLP incidents, malware and malicious-site alerts, application and network activity, and the user’s 30-day UCI history. A rules-based calculator then determines a baseline risk level, which the AI reviews and may raise (but never quietly lower) before writing the final human-readable investigation report.
3. Summarize tenant-wide patterns After all per-user investigations finish, the agent computes four summary cards across the watchlist, giving you a high-level view of the biggest risks across your entire organization.
Prerequisites
- Your tenant must be enabled for the Insider Threat AISecOps Agent (tied to the Insider Threat product entitlement).
- Optional: An EDR integration (CrowdStrike Falcon, SentinelOne Singularity, or Microsoft Defender for Endpoint) enables additional endpoint enrichment in investigations. See AISecOps Integrations for setup steps.
Accessing the Insider Threat AISecOps Agent
Log into the Netskope admin console and navigate to AISecOps > Views > Insider Threat.
About Insider Threat AISecOps Agent Page
Summary
The top of the page displays the page title, a status badge (for example, “Completed”), the date of the most recent run, and the number of users analyzed in that run. Below the header, a Summary section shows the agent’s plain-text assessment of your tenant’s overall risk posture.
About Cards
Below the summary, four cards highlight the most important patterns across your entire watchlist:
| Card | What it shows |
|---|---|
| Malicious Site Visits | Users who visited known phishing, exploit, or command-and-control sites |
| Critical Risk Users | Users whose final risk level reached Critical, ranked by lowest UCI |
| Active Malware | Users with malware, ransomware, trojan, or virus indicators |
| UCI Score Drop | Users whose UCI fell by more than 100 points — a significant deterioration |
Cards are ordered by risk level (Critical first). Click a card to filter the watchlist table to just the affected users; click it again to clear the filter. Clicking multiple cards applies an OR filter, showing users who match any of the selected cards.
User Watchlist Table
The User watchlist table lists all users currently being monitored, along with a summary of their risk status.
| Column | Description |
|---|---|
| User | The user’s email address (searchable) |
| Status / Risk | A risk status (Critical / High / Medium / Low), a verdict status (Legitimate / Inconclusive) when the AI has reached a verdict, or an investigation status (Queued / In Progress) while the investigation is still running |
| Watch Reason | How the user was added: Manual, Auto Risk Eval, or a watchlist group name |
| UCI | The user’s current UCI score |
| Risk Indicators | A breakdown of indicator types: alerts, anomalies, ransomware, trojan, virus, and malicious sites |
| Case | A link to a linked case, or its status, if one exists |
| Action | Remove the user, or access a small action menu |
Rows are sorted by risk level by default (Critical first). Users whose investigations haven’t completed yet appear at the bottom. Click any row to open the user detail panel.
Note: Removing a user is not permanent. If the user still meets the criteria for automatic selection or belongs to a monitored watchlist group, they may be re-added on a subsequent daily run.
Toolbar options
- Search — Filter the table by email address or risk note.
- Risk level filter — Filter by Critical, High, Medium, Low, Legitimate, or Inconclusive (each option shows a count).
- Watch reason filter — Filter by Manual, Auto Risk Eval, or individual group names.
- Add users — Add individual users, a list of users, or a CSV to the watchlist.
- Settings (gear icon) — Configure watchlist groups for automatic daily monitoring.
When you select one or more rows using the checkboxes, the toolbar switches to a bulk action bar where you can Create cases or Remove the selected users.
User Detail Panel
Clicking a user opens a detail panel beside the watchlist. The panel shows a header with the user’s display name, risk or verdict status, email address, and the analysis period, followed by the full investigation.
Note: The content of the user detail panel is dynamically generated. The sections and findings shown may vary depending on the data available for the user under investigation.
Summary and risk hero
The primary write-up, consisting of a short verdict paragraph followed by three to five bulleted findings (for example, “42 uploads to personal Gmail outside business hours”). Mitigating Factors appear alongside, offering the alternative, non-worst-case explanation for the user’s behavior.
Create or Link Case
A button to elevate the user to a full AISecOps case. It is disabled until the investigation completes. A collapsible list below shows any previously created cases for this user, including date, status, and assignee. See elevating to a case below.
Risk indicator tiles
Five tiles summarize key metrics at a glance: UCI Score (with a trend arrow), Anomalies (with the percentage detected by machine-learning models), DLP, Malware, and Malicious Sites. Clicking the UCI Score, Anomalies, or DLP tile scrolls to the corresponding detail section in the panel.
Activity timeline
Notable events over the investigation window, with critical events expanded.
UCI Score trend chart
The user’s UCI history over time, with reference lines at 700 (good) and 500 (warning), plus a short written analysis of the trend.
Anomaly breakdown
Includes severity distribution, the machine-learning-detected percentage, a trend badge (Escalating / Stable / Declining), and collapsible groups of anomaly types.
DLP Incidents
Incident counts by severity, a breakdown by application, and the most recent incidents.
Recommended actions
Each action includes an urgency tag (for example, Immediate / Within 24 hours / This week / Monitor) and a one-line rationale.
Understanding risk levels and verdicts
Each investigated user receives one of the following labels in the watchlist and detail panel:
Risk levels — assigned when the AI determines there is an active concern:
| Level | Meaning |
|---|---|
| Critical | Immediate attention warranted. Typically involves a combination of severe UCI drop, active malware, critical DLP incidents, and abnormal behavior. |
| High | Significant risk indicators present; investigate soon. |
| Medium | Some risk indicators present; monitor closely. |
| Low | Minimal indicators; no immediate action required. |
Verdicts — assigned when the AI reaches a definitive conclusion:
| Verdict | Meaning |
|---|---|
| Legitimate | The AI determined the activity is sufficiently explained by normal business behavior. |
| Inconclusive | Insufficient data to reach a clear risk verdict. |
Note: When a user receives a Legitimate or Inconclusive verdict, those labels appear in place of a risk level color in the table and panel.
Adding users to the watchlist
Click Add users in the toolbar to open the Add Users dialog. You can add users in three ways:
- Search by name or email — A live directory lookup; select from the results.
- Paste a comma-separated list of emails — Enter multiple addresses at once.
- Upload a CSV — Bulk-add users from a file.
Users already on the watchlist display an “ADDED” badge and cannot be re-added. The dialog shows a running count of selected users; click Add (N) to confirm.
Configuring watchlist groups
To automatically monitor all members of a specific group every day, click the gear icon in the toolbar to open the Watchlist Configuration dialog.
Under Auto Add — User Groups, select one or more user groups (for example, Executives, Finance, or Contractors). Members of these groups are expanded and added to the watchlist on every daily run. For each group, you can:
- Add an optional comment explaining why the group is monitored.
- Toggle the group on or off without removing it from the configuration.
- Remove the group entirely.
Tip: Watchlist group members and manually added users are not subject to the per-run auto-selection limit (default: 20 users). They are always investigated.
Elevating to a case
After reviewing a user’s investigation, you can escalate them to a full AISecOps case in one click using Create or Link Case in the detail panel, or Create cases in the bulk action bar when multiple rows are selected.
An elevated case is titled “Insider Threat: <user>” and behaves exactly like a DLP case — it appears in the standard AISecOps case list and supports assignment, comments, status changes, audit trail, ITSM ticketing, and notifications. A single user can accumulate multiple linked cases over time; all of them appear in the detail panel under a collapsible previous-cases list.
For more information on working with cases, see Case Creation.
Common use cases
Daily triage of your riskiest users Open the Insider Threat page each morning to a pre-ranked watchlist with risk levels, UCI scores, and indicators — no setup required. The agent automatically selects and investigates your top users.
Understanding why a user is flagged Click any user to open the detail panel, which explains the risk verdict in plain language, shows the UCI trend, breaks down anomaly types, and lists recommended next steps.
Monitoring departing employees or high-risk groups Add departing employees manually, or configure a group (for example, users on a PIP or contractors in their final weeks) once, and the agent investigates every member automatically each day.
Detecting compromised accounts The agent correlates malware indicators, behavioral anomalies, and off-hours activity. Affected users are surfaced under the Active Malware and Critical Risk Users finding cards.
Bulk investigation requests Suspect a set of specific users? Add them by email list or CSV upload; the next daily run produces a full investigation for each one automatically.