Insider Threat Management: Connecting the Dots Before an Incident

8.09.2026

All Things Internal Audit

0:00

36:03

The Institute of Internal Auditors Presents: All Things Internal Audit

In this episode, Sanjay Vadlamani talks with Yvette Adams about how insider threats extend beyond malicious employees. They discuss negligent, malicious, and compromised insiders, along with the ways AI, remote work, cloud applications, and expanding access have increased organizational risk. The conversation also covers behavior monitoring, employee privacy, access management, offboarding, multidisciplinary risk teams, and the importance of connecting information across organizational silos before a threat becomes an incident.

HOST:
- Sanjay Vadlamani, CIA, CISA, CRISC Senior Manager, Internal Audit, PayJoy

GUEST:
- Yvette Adams, CIA, CRMA
  Director of Enterprise Risk Management, Zions Bancorporation

KEY POINTS:

Introduction [00:00–00:00:38]
The Three Types of Insider Threats [00:00:39–00:03:19]
How AI, Remote Work, and Cloud Applications Increase Risk [00:03:20–00:06:52]
IIA Membership [00:06:53–00:07:38]
Balancing Employee Monitoring, Privacy, and Trust [00:07:39–00:11:13]
Indicators of Insider Risk [00:11:14–00:15:16]
The FinWise Bank Incident and Offboarding Risk [00:15:17–00:18:48]
Connecting Information Across Organizational Silos [00:18:49–00:22:47]
Five Elements of a Mature Insider Risk Program [00:22:48–00:26:40]
Lessons From the Tesla Insider Threat Case [00:26:41–00:28:56]
Understanding the Insider Threat Life Cycle [00:28:57–00:30:07]
Employee Self-Reporting and Where Organizations Should Start [00:30:08–00:33:40]
Closing [00:33:41–00:33:51]