One number for how exposed you are to your own people.
Twenty questions, five weighted pillars, a score out of 100 benchmarked against your industry and company size. Free, no account, about eight minutes.
No registration. Results on screen immediately. Board-ready PDF if you want one.
The scale
Score 47 out of 100, level 3 of 5, Managed.
47 is the running average across 1,247 assessments. Your score is placed on this scale and against peers of your industry and size.
- Average annual cost of insider risk per organization
- $19.5MAverage annual cost of insider risk per organizationPonemon / DTEX, Cost of Insider Risks 2026
- Average time to contain a single incident
- 67 daysAverage time to contain a single incidentPonemon / DTEX 2026, down from 86 in 2023
- Of breaches that involve a human element
- 62%Of breaches that involve a human elementVerizon DBIR 2026
Five pillars, weighted by how much they move the outcome
The weights come from incident data, not opinion. A program usually fails because one pillar is near zero, which is why the score shows the breakdown and not just the total.
Visibility
Whether you would see it happen at all.
25%Prevention & Coaching
Whether people are steered away from the risky path before they take it.
25%Investigation & Evidence
Whether an incident resolves into something you can act on.
20%Identity & SaaS/OAuth
Whether access matches the person, still, today.
15%Phishing Resilience
Whether a convincing message turns one person into an entry point.
15%
What each band actually means
The level matters more than the number. Moving one band is a year of work, and the report tells you which pillar buys that move most cheaply.
- 0–24
Ad Hoc
No program to speak of. Incidents are discovered by accident.
- 25–44
Emerging
Controls exist in pockets. Nothing is consistent across teams.
- 45–64
Managed
The program runs, but evidence is thin and response is manual.
- 65–84
Proactive
Behavior is baselined, investigations hold up, response is fast.
- 85–100
Optimized
Measured, rehearsed, and improving. Insider risk is a managed line item.
Recent research
Published analysis of how insider risk is actually changing, with sources you can check.
MCP Servers: The Insider You Cannot Attribute (2026)
Model Context Protocol servers hold standing credentials and act with their own identity, not the caller's. That collapses attribution, the foundation of every insider investigation. What MCP insider risk is, why shadow MCP servers are the new shadow IT, and how to govern it.
AI Coding Assistants and Source Code: The Insider Risk Hiding in Your IDE (2026)
Copilot, Cursor, and AI IDEs turned every developer into a data-egress point for the crown jewels. What leaks, why it is an insider risk and not just an AppSec problem, and how to govern it without killing velocity.
Data Poisoning: The Insider Threat That Attacks Your AI From Within (2026)
In 2026 the insider risk lens inverts. Instead of leaking data through AI, a trusted insider can corrupt the data AI learns from. What insider data poisoning is, what it targets, why it is so hard to detect, and how to defend against it.
No vendor writes this index
The assessment is free and takes no account. No vendor pays to appear in the comparisons or sees one before it publishes, and the scoring criteria are published so you can disagree with them.
- Questions
- 20, each mapped to a published research source
- Pillars
- 5, weighted from incident outcome data
- Benchmarks
- By industry and company size, recomputed as responses arrive
- Technique mapping
- Forscie Insider Threat Matrix, Apache 2.0
- Cost
- Free, no account required
Find your number
Eight minutes, twenty questions, and a result you can put in front of a board without defending the source.