Insider Threat Management (ITM) software is a user activity monitoring software that helps companies prevent internal users from taking malicious or negligent actions within systems, such as accessing, copying, removing, tampering with, or destroying company data or other assets without permission. Companies use ITM software to monitor and record the actions of internal system users on their endpoints, such current and former employees, contractors, business partners, and other permissioned individuals, in order to protect company assets, such as customer data or intellectual property. ITM software is used by IT or security professionals. ITM software provides a critical role in a company's overall security strategy, as security tools that focus on external threats to systems or networks are often not able to detect the nuanced threats of internal, permissioned users.
ITM software often integrates with identity and access managment (IAM) software tools to pull internal user data. ITM tools also often integrate with security information and event mangement (SIEM) software tools and other threat analytics systems to centralize security operations into a single location. Many ITM software soltuions have functionality which overlaps with privileged access management (PAM) software, data loss prevention (DLP) software and user and entity behavior analystics (UEBA) software, however these tools have different uses. PAM is used to monitor the actions of privileged users. DLP tools detect sensitive data leaks. UEBA software uses machine learning to detect anomolies from benchmark useage; this is different from ITM software which utilizes endpoint sensors and contexutal user data to uncover insider threat risks.
To qualify for inclusion in the Insider Threat Management category, a product must:
Monitor user endpoints and trigger alerts when insider threat actions are taken
Detect data movement to external USBs or external drives or uploaded to cloud storage or emails, excessive printer-usage, and copy/cut/paste keystroke usage on user endpoints
Provide session video recording, screen captures, and keystroke logging as evidence of malicious or negligent action
