Triage: Separating Mistakes From Malice

Triage is where a programme succeeds or becomes theatre. Detection produces candidates; triage decides which deserve attention, and doing it badly either buries the real cases or generates investigations of innocent people.

The order of questions

Is it a legitimate business process? Ask this first, always. Most alerts are. If the answer is yes, the finding is a tuning task, not an incident.

Is the account compromised? Before treating anomalous behaviour as an employee's choice, rule out that someone else is using the account. It is the more common explanation and quicker to check — location, device, authentication pattern, concurrent sessions.

Getting this order wrong is how organisations end up investigating a victim.

Was it an error? Wrong recipient, wrong attachment, wrong folder. Look at whether the action was repeated or corrected. People who make a mistake usually notice.

Was it a shortcut? Someone bypassing an inadequate process to do their job. Common, not malicious, and the finding is about the process.

Only then: was it deliberate? And even here, deliberate does not mean malicious. Someone emailing themselves a document to work on at home has acted deliberately and has not stolen anything.

What raises the concern level

None of these is proof. Together they change the picture.

Timing relative to employment events. Resignation, notice period, a performance process, a redundancy announcement. Context transforms interpretation of the same activity.

Concealment. Renaming files, using encryption, clearing logs, acting outside working hours without a reason. Concealment is the single strongest indicator, because errors are not hidden.

Volume and breadth. Systematic collection across systems rather than a single file.

Access outside role. Interest in material the person has no business reason to touch.

Repetition after intervention. Someone warned once and doing it again.

What does not indicate malice

A high anomaly score alone. Unusual is not wrong.

Working unusual hours. Time zones, caring responsibilities, a deadline, personal preference.

High volume in a role that involves high volume. Compare against the person's own baseline and their peers, not an abstract threshold.

Using a consumer service because the corporate one is inadequate. This is a finding about your tooling.

The conversation option

The most under-used response: ask the person.

For the majority of alerts — the error and shortcut categories — a short, non-accusatory conversation resolves it in minutes, produces a better outcome than an investigation, and frequently reveals a process problem worth fixing.

It requires the conversation to be genuinely non-accusatory, and it requires the person asking to be able to distinguish a question from an interrogation. Where the concern is serious, this step is skipped for good reason — but it is skipped far more often than it should be.

Documenting the decision

Every triaged alert should record what was decided and why, briefly.

Two reasons. Patterns only become visible across time, and an alert dismissed three times by three people is a pattern nobody saw. And if a case does escalate, the earlier decisions are part of the record.

The threshold for escalation

Define it in advance rather than case by case: evidence suggesting deliberate action, and either significant data volume or high-sensitivity categories, and no benign explanation identified.

At that point it stops being triage and becomes an investigation with HR and legal involved — with the process, restrictions and documentation that entails.