Which of the following lists three indicators of an insider threat to watch for in an employee?

• A. Unexplained early arrival or late departure; staff in areas not related to their job function
• B. Staff removing documents from the facility; staff asking sensitive questions
• C. Unexplained early arrival or late departure; staff in areas not related to their job function; staff removing documents from the facility
• D. Staff bringing a camera to work

Answer: (C)

Insider threat indicators come from noticing patterns in how an employee accesses time, space, and information. Unexplained early arrival or late departure suggests they’re spending time beyond what their duties require, which can indicate trying to access systems or data outside normal hours. Being seen in areas not related to their job function points to access outside their role and room to observe sensitive operations, a red flag for potential misuse. Removing documents from the facility is a direct signal that someone may be exfiltrating information or handling sensitive materials improperly. When these three signs appear together, they create a stronger, cohesive picture of insider risk than any single behavior alone.

Other options may raise privacy or security concerns in isolation—like bringing a camera to work—but without the combination of time, location, and data-handling anomalies, they’re not as reliable as an indicator of insider threat.