Security architectures are built to stop unauthorized logins. Insider risk is what happens when the login is entirely legitimate.
When a departing employee, compromised account, or contractor accesses sensitive files, single sign-on passes. Multi-factor authentication passes. The device is trusted, permissions match their role, and the files sit well within their assigned rights. To your identity provider and network perimeter, nothing is wrong.
Most insider risk tools operate downstream of this moment: they watch what happens next, record user behavior, and fire an alert. But an alert is not a boundary.
Evaluating insider risk software comes down to a fundamental distinction: which tools merely observe data movement, and which ones enforce controls on the file itself before it exits?
What Can an Insider Open Before Anyone Notices?
Insider risk tools watch behavior and raise alerts. Per-file control limits what a valid login can open at all. See where your current stack stops in a two-week pilot.
What Insider Risk Management Software Does
Insider risk management software looks for risky behavior by people who already have legitimate access: employees, contractors, partners, and anyone holding valid credentials. The risk can be malicious, such as theft ahead of a resignation. It can also be negligent, such as sending the wrong file to the wrong address, or compromised, such as an account in someone else's hands.
Most tools do some mix of four things: collect activity data from endpoints, email, cloud apps, and file systems; establish what normal looks like; score deviations from it; and route alerts to a person for review.
Underneath every tool is the same assumption: the insider is already inside, so you cannot stop the login. You can only watch what follows, and decide what to do about it.
One disclosure before the list. Theodosian sells in one of these layers, and we have a point of view. We have tried to describe every tool, including ours, by what it sees and where it stops. Where a competitor does something we do not, we say so. Our related reading on the threat itself: What Is an Insider Threat, and Why Detection Alone Won't Stop It.
The Five Layers of Insider Risk Management
| Layer | The Question It Answers | Example Tools | Where It Stops |
|---|---|---|---|
| 1. Platform-native risk analytics | Is this behavior unusual inside the platform I already use? | Microsoft Purview Insider Risk Management | Strongest inside the home platform |
| 2. Behavioral analytics (UEBA) | How does this user's behavior compare with their baseline and their peers? | DTEX InTERCEPT, Forcepoint Insider Threat | Detection and scoring, then a person decides |
| 3. Endpoint and data-movement monitoring | What did this person do with the data on their device? | Proofpoint ITM, Code42 Incydr (by Mimecast), Teramind | Watches and alerts. The file leaves intact |
| 4. Access and permission visibility | Who can reach what, and who touched it? | Varonis | Shows access. Does not protect a file that has left |
| 5. Object-Level Control & Governance | Where is sensitive data, who/what can reach it, and can a valid login open it once it leaves? | Theodosian | Focuses on file and egress security; does not replace broad endpoint UEBA |
Read the right-hand column. Layers 1 through 4 detect or reveal. None of them changes what the insider can read. That is what Layer 5 is for.
Layer 1: Platform-Native Risk Analytics
Microsoft Purview Insider Risk Management
What it does: Identifies risky activity by users inside the Microsoft environment, with policies, risk scoring, and analytics tied to Microsoft 365 signals.
Strengths: Native to the Microsoft stack, bundled into E5 licensing for many enterprises,
and one of the highest mindshares in the insider risk category on PeerSpot.
Where it stops: Its view follows the Microsoft boundary. Activity on a personal drive or a non-Microsoft app is a blind spot. See Theodosian vs. Microsoft Purview.
Ideal for: Microsoft-centric organizations that want a first line of insider detection without adding a vendor.
Layer 2: Behavioral Analytics
DTEX InTERCEPT
What it does: Metadata-based behavioral analytics designed to score risk without inspecting content, which many organizations value for privacy and works-council reasons.
Strengths: Privacy-aware design and breadth of behavioral indicators across endpoints.
Where it stops: It scores behavior and raises a flag. A person has to review and respond. It does not change what the account can open.
Ideal for: Large enterprises that want behavioral risk scoring with privacy constraints.
Forcepoint Insider Threat
What it does: Security analytics for detecting and mitigating malicious or policy-violating employee behavior, building on Forcepoint's broader data security portfolio.
Strengths: Policy depth and integration with the rest of the Forcepoint platform.
Where it stops: Same boundary: behavior detection and policy response, not control of the file after it leaves.
Ideal for: Organizations already invested in Forcepoint's platform.
Layer 3: Endpoint and Data-Movement Monitoring
Proofpoint Insider Threat Management
What it does: Endpoint-level monitoring and data-movement detection with context on user activity, alongside Proofpoint's email and DLP products.
Strengths: Good fit for communication-heavy organizations, and visibility into what happened on a device.
Where it stops: It records and alerts. A file that has already left is not recalled by the alert.
Ideal for: Enterprises that already run Proofpoint for email security and DLP.
Code42 Incydr (Mimecast)
What it does: Detects data risk as files move to personal cloud, removable media, email, and other destinations, with a focus on data in motion.
Strengths: Focused on departing-employee and exfiltration scenarios.
Where it stops: It sees movement. It does not make the moved file unreadable.
Ideal for: Teams whose main concern is data leaving with departing employees.
Teramind
What it does: Monitors user activity on endpoints to detect insider threats and data leaks, with options for recording and behavioral analytics.
Strengths: Deep visibility into on-screen and endpoint activity.
Where it stops: Depth of visibility raises privacy and employee-relations questions that you should settle before deploying. It watches. It does not protect the file.
Ideal for: Organizations that need granular activity monitoring and have worked out the privacy implications.
Layer 4: Access and Permission Visibility
Varonis
What it does: Maps who can reach which data across file shares and collaboration platforms, with monitoring of access activity.
Strengths: The deepest view of permission sprawl on unstructured data.
Where it stops: Varonis shows you where the file is and who touched it. It does not encrypt the file, and once a file leaves the systems Varonis monitors, visibility ends. Read the full comparison: Theodosian vs. Varonis.
Ideal for: Enterprises that need to understand and reduce who can reach what.
Layer 5: Object-Level Control & Governance
Theodosian
What it does: Connects to cloud environments to automatically discover and classify sensitive data, enforce egress rules for users and AI tools, and apply persistent, per-file FIPS 140-3 validated encryption. Access decisions are evaluated in real time at the moment of opening, traveling with the file wherever it resides.
Strengths: Protection survives data movement, local downloads, and third-party sharing. Prevents unauthorized AI ingestion and restricts valid logins from opening files if policy rules change. Anomaly detection enables automated access freezes ("Drop the Gate").
Where it stops: Theodosian does not perform full-system endpoint session recording or replace network/EDR tools. It enforces security at the data layer rather than monitoring all host-level process activity.
Ideal for: Organizations requiring active control over sensitive unstructured data, AI tool egress, and persistent file protection
The Operational Gap: Why Telemetry Is Not Control
Detection tools across Layers 1 through 4 answer a crucial question: what happened? They deliver alerts with varying degrees of speed, depth, and privacy.
However, detection tools introduce a latency gap:
Detection Alert Routing Analyst Review Manual Intervention
During this window, a valid login with legitimate permissions can extract sensitive files, share them externally, or paste them into unapproved AI tools.
Per-file control changes this sequence. By tying access decisions and encryption directly to the object, security rules enforce themselves regardless of where the file moves or who holds it.
Detection identifies strange behavior. Object-level control determines what that behavior can actually access. Mature security programs combine both.
How to Choose: Seven Questions for Any Insider Risk Vendor
- What does it do between the alert and the response? If the answer is "a person reviews it," ask how fast and who.
- Can it act, or only watch? Alert-only tools depend on your response time.
- How does it stop sensitive data from reaching unauthorized AI tools? Ask whether the system can actually prevent an insider or contractor from pasting or uploading sensitive files into an external LLM, or if it just alerts you after the prompt is sent.
- How does it handle privacy and employee relations? Content inspection and screen recording carry real legal and cultural cost. Settle that early.
- How many false positives should you expect, and who triages them? An alert queue nobody works is not a control.
- What happens to the file after it leaves? Ask for the answer on a file emailed outside or copied to a personal drive.
- How does it handle departing employees specifically? This is the most common insider scenario, and the one with the clearest timeline.
Match the Tool to the Problem
If you are a Microsoft shop with no insider tooling, start with Layer 1. Purview Insider Risk Management is the lowest-friction first step.
If privacy constraints shape what you can monitor, look at Layer 2, where metadata-based approaches avoid content inspection.
If your concern is departing employees and data leaving, Layer 3 covers movement to personal destinations.
If you do not know who has access to what, start with Layer 4. You cannot limit what you cannot see.
If valuable files routinely sit within reach of broad access, Layer 5 is the layer you are missing, and it is the only one that works before the alert.
Most mature programs run two or three layers together.
Map Your Own Stack in Two Week
We map where your sensitive unstructured data lives, then show you what happens when a file is downloaded, copied outside the company, or fed into an external AI tool. You finish with a clear view of your exposure and a control that works before the alert.
FAQs: Insider Risk Tools and File-Layer Control
If we already have an insider risk tool, what does Theodosian add?
Insider risk tools watch behavior and raise alerts. Theodosian adds a control that limits what a valid login can open and keeps working after a file leaves: a unique key per file and an access decision every time someone tries to open it. You keep your insider risk tool. In a pilot, we show what a flagged user can still open on your own files, with and without per-file control.
Does Theodosian replace Purview, DTEX, Proofpoint, or Varonis?
No. Those tools detect behavior or reveal access. Theodosian does not monitor behavior across endpoints. It protects the file itself. Many organizations need both, because they answer different questions: what happened, and what could this person open.
What happens when a departing employee copies files to a personal drive?
For files protected by Theodosian, the copy is encrypted, and opening it requires an access decision against your current policy. If the employee's access has been narrowed or removed, the copy cannot be read, and the attempt is logged. For files that are not protected, there is no such control. In the pilot you test this on your own files: protect a set, copy them out, then restrict the user and watch what happens.
Can Theodosian respond automatically when something looks wrong?
Anomaly detection can trigger Drop the Gate, an autonomous access freeze for the affected identity and files, without waiting for a manual review. Freezes are reversible and recorded, so a security reviewer can restore access once the event is checked. We describe this as a protective pause on the files Theodosian protects, not as monitoring of all of your endpoints.
Can an administrator remove encryption from a file?
Yes. An administrator can remove encryption from a file, and re-protecting it creates a new key. Treat admin accounts as privileged accounts and cover them in your privileged access program, the same way you would any role that can change the controls themselves.
What would a two-week pilot show us?
We protect a defined set of your files over your existing Microsoft 365, Google Workspace, or cloud storage, with no data migration. You see what happens when a file is downloaded, copied outside the company, and restricted, plus the per-file access record from your own environment. You finish with a direct answer to the question your detection tools cannot: what can a valid login open?
Related Reading:
What Is an Insider Threat, and Why Detection Alone Won't Stop It
The Insider Threat That Breaks the Perimeter Model
What Happens to Your Sensitive Files When a Contractor Leaves?
What Stops an Attacker Who Has Valid Credentials From Accessing Your Files?
🔍 Contractor Access Audit: Every contractor is an insider with a login and a copy. Use our Contractor Offboarding File Security Checklist to find out which files are still out there.
🤖 AI Access Audit: An insider can paste files into an AI tool as easily as into a personal drive. Use our Shadow AI Risk Assessment Checklist to map where that happens.