Thank you Sergio. You have helped me to see a good point (all insiders have authorization of one level or another to use resources of a company they work for. Hence the question should be how to identify risky insiders?).

What are the Behavioral Risk Indicators of Malicious Insider?

Thank you Sergio. The risky behavioral indicators a,b,c are obvious because are after the fact behaviors but what would be subtle behaviors, assumptions that can be said are characteristic to a would be malicious insider? Let us delve into psychological criminality profile.

I would like to add Sergio

D) users who escalated their privileges

E) users who were fixed in the honeyports/honeynets