Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
The Insider Threat Study, conducted by the U.S. Secret Service and Carnegie Mellon University's Software Engineering Institute CERT Program, analyzed insider cyber crimes across U.S. critical infrastructure sectors. The study indicates that management decisions related to organizational and employee performance sometimes yield unintended consequences magnifying risk of insider attack. Lack of tools for understanding insider threat, analyzing risk mitigation alternatives, and communicating results exacerbates the problem. The goal of Carnegie Mellon University's MERIT (Management and Education of the Risk of Insider Threat) project is to develop such tools.4 MERIT uses system dynamics to model and analyze insider threats and produce interactive learning environments. These tools can be used by policy makers, security officers, information technology, human resources, and management to understand the problem and assess risk from insiders based on simulations of policies, cultural, technical, and procedural factors. This paper describes the MERIT insider threat model and simulation results.
Cite This SEI Report
Cappelli, D., Desai, A., Moore, A., Shimeall, T., Weaver, E., & Willke, B. (2008, May 1). Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System. Retrieved September 11, 2026, from https://www.sei.cmu.edu/library/management-and-education-of-the-risk-of-insider-threat-merit-system-dynamics-modeling-of-computer-system/.
@techreport{cappelli_2008,
author={Cappelli, Dawn and Desai, Akash and Moore, Andrew and Shimeall, Timothy and Weaver, Elise and Willke, Bradford},
title={Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System},
month={May},
year={2008},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/management-and-education-of-the-risk-of-insider-threat-merit-system-dynamics-modeling-of-computer-system/},
note={Accessed: 2026-Sep-11}
}
Cappelli, Dawn, Akash Desai, Andrew Moore, Timothy Shimeall, Elise Weaver, and Bradford Willke. "Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, May 1, 2008. https://www.sei.cmu.edu/library/management-and-education-of-the-risk-of-insider-threat-merit-system-dynamics-modeling-of-computer-system/.
D. Cappelli, A. Desai, A. Moore, T. Shimeall, E. Weaver, and B. Willke, "Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 1-May-2008 [Online]. Available: https://www.sei.cmu.edu/library/management-and-education-of-the-risk-of-insider-threat-merit-system-dynamics-modeling-of-computer-system/. [Accessed: 11-Sep-2026].
Cappelli, Dawn, Akash Desai, Andrew Moore, Timothy Shimeall, Elise Weaver, and Bradford Willke. "Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 1 May. 2008. https://www.sei.cmu.edu/library/management-and-education-of-the-risk-of-insider-threat-merit-system-dynamics-modeling-of-computer-system/. Accessed 11 Sep. 2026.
Cappelli, Dawn; Desai, Akash; Moore, Andrew; Shimeall, Timothy; Weaver, Elise; & Willke, Bradford. Management and Education of the Risk of Insider Threat (MERIT): System Dynamics Modeling of Computer System. Software Engineering Institute. 2008. https://www.sei.cmu.edu/library/management-and-education-of-the-risk-of-insider-threat-merit-system-dynamics-modeling-of-computer-system/