"It ultimately comes down to data," said George Spencer, Senior Director of Corporate Development and Strategy at Everfox.
Why agencies such as the FBI are prime targets
Spencer's point is simple and central: government agencies hold "enormous amounts of highly valuable information, including personally identifiable information, operational data, intelligence, and mission‑critical assets." That mix creates both financial and strategic incentives for attackers. The source material names a wide range of adversaries — cybercriminals, nation‑state actors, advanced persistent threat groups, and organized operators such as ShinyHunters — all drawn to the value of government data. As agencies continue to generate and store more information, Spencer warned, "the more data an enterprise has, the larger the potential attack surface."
Recent insider incidents that framed the debate
The risk from inside the firewall is not hypothetical. The piece cites multiple high‑profile incidents that illustrate the threat vector: an Air Force National Guard IT specialist, Jack Teixeira, who "leaked top‑secret intelligence to a public Discord server" just three years ago; historical disclosures by Chelsea Manning in 2010 and Edward Snowden in 2013; and cases where "North Korean operatives have been posing as American IT and technology workers to get jobs at private companies that provide tools and services to the federal government." Those examples, the interview makes clear, are part of a larger pattern of insider incidents that have "plagued our government."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildMalicious actors and ordinary mistakes: two different risks
Spencer distinguishes two broad categories of insider risk. "One of the biggest misconceptions about insider threats is that they are always malicious. That’s not the case," he said. Employees may mishandle information out of negligence, lack of awareness, or poor judgment — for example using unauthorized tools or failing to follow procedures — rather than deliberate wrongdoing. Those situations, he emphasized, often require "education, coaching, and stronger security awareness rather than disciplinary action." The distinctive challenge of insider risk, he added, is that insiders already possess vetted access — clearances and permissions — which can be leveraged, intentionally or not, against an organization.
AI and productivity tools: a second frontier for insider risk
New productivity technologies complicate the picture. Spencer compared the current adoption of artificial intelligence to "many of the same challenges we saw when cloud services first became mainstream." Employees will use tools like ChatGPT and Copilot to be more efficient; the problem arises "when sensitive information enters environments where it shouldn’t." He warned that an employee "may believe they’re improving efficiency by uploading data to an AI platform, but they may not fully understand the security, compliance, or policy implications." Agencies therefore need visibility into how those technologies are being used, to "identify and mitigate that risk while still enabling innovation and productivity."
Everfox and the FBI: collection, insight, governance
Everfox recently partnered with the FBI to "support advanced insider‑risk protections and behavioral analytics initiatives." According to Spencer, the tactical value of such partnerships begins with "strong data collection," which enables analytics that surface behavioral patterns and produce "actionable insight" rather than noise. He laid out a three‑part framework: "The strongest insider‑risk programs combine three key elements: collection, insight, and governance." That governance piece includes "policies, privacy protections, legal oversight, and stakeholder collaboration" — not technology alone — because "insider risk is truly a team sport." Agencies can then evaluate user activities "in the context of a user’s role, permissions, and expected behavior" to prioritize investigations and determine whether intervention is needed.
What this means for security teams, policymakers, and the public
- Security teams and technologists: They must build visibility into both human behavior and tool usage, pair analytics with role‑aware context, and couple technical controls with training and coaching to address negligence as well as malice.
- Policymakers and legal overseers: Spencer’s framing makes governance central — policies, privacy protections, and legal oversight must accompany any technical program to balance investigation with rights and trust.
- The public and mission owners: For federal agencies, effective insider‑risk programs "translate directly into stronger national security outcomes," since protecting operational data and intelligence supports mission effectiveness.
Spencer underscored the balancing act: mature insider‑risk programs must "balance security, privacy, governance, workforce trust, compliance, and mission effectiveness at the same time." The partnership between Everfox and the FBI, and the emphasis on collection, insight, and governance, illustrate a practical approach agencies are adopting: combine data and analytics with legal and organizational safeguards to detect risk early and respond before networks and data are compromised.
