Developing Insider Risk Metrics from Host-Based Monitoring
• SEI Report
Publisher
Software Engineering Institute
DOI (Digital Object Identifier)
10.1184/R1/13424687Topic or Tag
Abstract
Host-based monitoring capabilities collect vast amounts of data on information system usage and end-user behavior. This data aids in all phases of incident handling, including detection, response, forensics, mitigation, and prevention. Host data also serves a critical role in establishing activity baselines to understand normal behavior and identify abnormal or unexpected events. Metrics derived from host-based monitoring can inform insider threat risk models and illuminate concerning precursors before an undesirable escalation of events occurs. In this paper, we (1) review and define standard host-based monitoring capabilities, (2) identify related insider threat indicators that can be measured using host-based data sources and describe a vendor-neutral implementation approach, and (3) discuss the state of the art of host-based monitoring for insider risk measurement and associated challenges.
Cite This SEI Report
Gardner, C., Costa, D., & Albrethsen, M. (2021, February 15). Developing Insider Risk Metrics from Host-Based Monitoring. Retrieved September 13, 2026, from https://doi.org/10.1184/R1/13424687.
@techreport{gardner_2021,
author={Gardner, Carrie and Costa, Dan and Albrethsen, Michael},
title={Developing Insider Risk Metrics from Host-Based Monitoring},
month={Feb},
year={2021},
institution={Software Engineering Institute, Carnegie Mellon University},
doi={10.1184/R1/13424687},
url={https://doi.org/10.1184/R1/13424687},
note={Accessed: 2026-Sep-13}
}
Gardner, Carrie, Dan Costa, and Michael Albrethsen. "Developing Insider Risk Metrics from Host-Based Monitoring." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, February 15, 2021. https://doi.org/10.1184/R1/13424687.
C. Gardner, D. Costa, and M. Albrethsen, "Developing Insider Risk Metrics from Host-Based Monitoring," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 15-Feb-2021 [Online]. Available: https://doi.org/10.1184/R1/13424687. [Accessed: 13-Sep-2026].
Gardner, Carrie, Dan Costa, and Michael Albrethsen. "Developing Insider Risk Metrics from Host-Based Monitoring." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 15 Feb. 2021. https://doi.org/10.1184/R1/13424687. Accessed 13 Sep. 2026.
Gardner, Carrie; Costa, Dan; & Albrethsen, Michael. Developing Insider Risk Metrics from Host-Based Monitoring. Software Engineering Institute. 2021. DOI: 10.1184/R1/13424687. https://doi.org/10.1184/R1/13424687