Insider Threat Toolkit
Do you have a question about how to do something or need more information about a topic? This toolkit will quickly point you to the resources you need to help you perform your role in the Insider Threat field. More Industry Insider Threat Information and Resources information are available at external link icon. Select a category to start accessing resources.

National Insider Threat Awareness Month

The National Insider Threat Awareness Month (NITAM) website will help you identify a variety of activities and engagements available to your organization.

Insider Threat Training and Job Aids

Insider Threat Case Studies

Insider Threat Best Practices

DSCA Policy

DOD Policy

National Policy

Intelligence Oversight, Civil Liberties, and Privacy Act Issues

Establishing an Insider Threat Program/Conducting Response Actions

Job Aids

Cyber insider threats may arise due to both malicious acts and negligent security procedures.  The abuse of access rights, digital theft of materials,  and mishandling of physical devices can be associated with a variety of insider threats such as sabotage, theft, espionage, and fraud.  Malicious outsiders, through the use of phishing and ransomware attacks, represent a growing threat to both private companies and government agencies.  Logging, monitoring, and auditing of information system activities can lead to early discovery and mitigation of insider threats.  User activity monitoring (UAM) on classified networks is a required component of insider threat programs for government agencies and cleared industry.  The resources listed below may assist individuals and organizations to better recognize and protect against various cyber threats.

Orders, Directives, and Instructions

Resource Links

Job Aids


Webinars and Podcasts


Insider Threat Case Studies

Vigilance Campaign

Other than the required annual training, what can I do to keep the Vigilance message fresh? Instilling a sense of vigilance in the general workforce is a basic tenet of establishing an insider threat program. Annual awareness training is a start, but the message can diminish over time. Developing a vigilance campaign for your organization is an effective solution. Deploying regular messaging, awareness, and communications materials ensures that the general workforce is prepared to recognize and respond to the insider threat. The campaign can also serve as an introduction to your Insider Threat Program ensuring that everyone knows whom to report to and feels comfortable doing so.

Vigilance Campaign Materials


View Insider Threat Posters.

Job Aids/Case Studies/Tri-Folds

Videos/Interactive Shorts

Security Awareness Games

Targeted violence incidents are tragic, often unpredictable and evolve quickly. There are a number of targeted violence resources, and this toolkit tab is one of them -- to help organizations and their workforces understand targeted violence, what to look for and report with regard to indicators and behaviors, and how to respond in the event of an active shooter incident or other workplace violence event. Click on the links below to learn more.

What to Know

What to Report

How to Respond

The Defense Personnel and Security Research Center (PERSEREC) is committed to improving the efficiency, effectiveness, and fairness of the DOD personnel security and suitability programs. In furtherance of this mission, PERSEREC established The Threat Lab in 2018 to realize the DOD Counter-Insider Threat Program Director's vision to integrate the social and behavioral sciences into the mission space.

For more information about PERSEREC, please email For more information about The Threat Lab, please email CDSE provides links to PERSEREC and Threat Lab products to promote the applied use of research outcomes in the insider threat community.


Deadlines and Deliverables Card Game

Deadlines and Deliverables is designed to help you and your team learn the value of resilience while you navigate tough challenges, complex tasks and demanding timelines as a team. Start by watching the short introductory video, consult the instruction manual and then print out the cards to play!

Novels/Graphic Novels


Job Aids


PERSEREC BLUF: Bottom Line Up Front
Volume 3
Volume 2
Volume 1
The Insider: The PERSEREC Threat Lab Newsletter
Volume 3
Volume 2
Volume 1




White Papers

Case Studies

Problem-Based Learning Experience for Leaders


Adversity is a fact of life. There are times when we all struggle with issues at home and work. For some, these periods of stress can increase risks associated with insider threats. Individuals may be more vulnerable to targeting and recruitment by foreign intelligence entities, and they may also be more likely to travel down the critical pathway towards negative events. Individual Resilience is that inexpressible quality that allows some people to be knocked down by life and come back at least as strong as before. It helps individuals harden the target and develop behaviors, thoughts, and actions that promote personal wellbeing and mental health. Insider Threat programs promote personal resilience to mitigate risks associated with insider threats. Click on the links below to learn more.

Understanding Resilience

Best Practices

Critical infrastructure comprises the assets, systems, and networks, whether physical or virtual, considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.  Presidential Policy Directive 21 (PPD-21), Critical Infrastructure Security and Resilience, identifies 16 critical infrastructure sectors and designates responsibilities to associated federal sector-specific agencies.  Insider threats to critical infrastructure pose heightened risk due to the dependencies and interdependencies that exist among the critical sectors.

Orders and Directives

Resource Links

Job Aids


These resources are designed to support International Military Student Officers (IMSO) and other faculty and staff at facilities or installations hosting International Military Students (IMS). The goal of providing these resources is to help IMSO and international military student officers, faculty and staff understand what an insider threat risk is, what behaviors to look for, who to notify if they feel an insider threat is possible, and how to react if an insider threat situation escalates.

Awareness Training

IMSO Insider Threat Resources

Fraud is any activity that relies on deception in order to achieve a gain. Fraud becomes a crime when it is a knowing misrepresentation of the truth o concealment of material fact to induce another to act to his or her detriment. If an insider lies in order to deprive a person or organization of their money, property, or other resources, then they are committing fraud. Trusted insiders may pose a threat to their organization if they use their access to facilitate or commit fraud. Select the links below to learn more.

What to Know

What to Report

How to Respond

Federal and DOD policies establish minimum standards for Insider Threat Programs in government agencies, DOD Components, and cleared industry.  An effective counter-insider threat program's success relies heavily on an organization's senior leadership and its advocacy, support, and the culture of the organization.  The leadership tab provides leadership-specific resources to assist leaders in better understanding insider threats.

Understanding Insider Threat

Insider Threat Definitions Job Aid PDF icon
Insider Threat for Senior Leaders (8 minute Video Short)

Resources for Senior Leaders

Insider Threat Resources for Industry Senior Officials PDF icon
Customizable DOD Command Brief for Insider Threat Awareness PowerPoint icon
DOD Insider Threat Program Best Practices:  Strategic Communications PDF icon


Workplace Environment and Organizational Justice

Workplace Environment and Organizational Justice Job Aid PDF icon
Cultural Awareness in the Workplace
Toolkit feedback/suggestions? Email