Nightfall’s endpoint agents are a rich source of information for identifying any activity that places sensitive data at the risk of exfiltration. But they create a classic needle in a haystack problem - for some our customers they can be up to millions of events a week. While our powerful policies and forensic search features allow a SecOps analyst to look for specific types of behaviour, it is not practical for them to go over all the events to identify any “unknown unknowns”.
Nightfall’s Insider Risk agents are built to solve this problem. Every week, they analyse data movement from managed devices and answers one question for the security team: which activity warrants review, and why? Two AI-assisted stages do the work. The Triage Agent sorts a week of activity into a shortlist. The Investigator Agent then studies each person on that list and writes a verdict with evidence.
Stage 1: The Triage Agent
From a week of activity to a shortlist
The Triage agent operates on per user aggregates of data-movement events over a week. It then scores candidates with at least one direct warning signal (explained below) using our scoring model. The highest-scoring candidates are then passed to the Investigator agent. The Investigator agent assesses data security risk and provides evidence for review. Security teams determine whether activity is legitimate and what response, if any, is appropriate.
What it reads
The triage agent aggregates data across following three different sources to build a picture of each candidates’ weekly activity on the the endpoint devices.
Data movement from endpoint
The company directory
Nightfall’s App Intelligence
Events from Nightfall's Mac and Windows agents: browser uploads, copy-and-paste, cloud-sync folders, desktop-app uploads, code pushes, USB drives, printing, AirDrop and Bluetooth. Downloads are kept as context so the system can spot a file that came in and then went out.
Names, job titles and departments from the customer's identity provider (Okta, Microsoft Entra or Google Workspace). This lets the system compare people with peers in the same role.
Nightfall’s App intelligence Agents are built to automatically catalogue and classify data destinations. Our risk system builds on top of it identify loss of control scenarios.
How it makes sense of the data
- User and role: Each event is tied to a person. If a user has multiple devices registered to them, they, activity across all of them is aggregated and attributed to them. The Identity data is also used to identify who are their peers in the organisation which is used to baseline their behaviour so that we don’t flag activity which is common to their role.
- Destination trust: Each destination is placed in a trust tier. Company-owned sites and the company's own accounts on shared services are corporate. Consumer sites, personal logins, file sharing, social media and USB drives are untrusted. Partner and vendor tools are business external.
- Data Sensitivity: We use a combination of Nightfall’s custom detectors and LLMs to identify whether the moved data is sensitive in nature: financial, HR and personal data, customer contracts, source code, legal, or passwords and keys.
- Data ownership: People often move their own paperwork, such as their payslip or tax form, to a personal account. If everything sensitive a person moved was their own, they are not considered a risk candidate. Anything about a colleague, or any company data, may make them one - unless it is justified by their role.
How it ranks people
Before scoring candidates, the Triage agent excludes candidates with no direct warning signals.
Direct Warning Signals
Indirect Warning Signals
A sensitive file was downloaded and then sent somewhere untrusted
Departure signals - such as uploading resume/cover letters to resume sites
Sensitive data went to an untrusted destination
Off-hours activity, unusually high volume, unusually many destinations
Sensitive data moved while signed in to a personal account
Most sensitive files funneled to one unusual site
Bulk uploads to a file-sharing site
Files about other employees
Sensitive data pasted into AI tools, or personal cloud sync
A destination type almost nobody else in the company uses
We distinguish direct warning signals which require movement of sensitive data from indirect warning signals like departure signals or outlier activity. The latter do not change the risk assessment by themselves but can serve as additional evidence.
Signals by themselves do note imply insider activity. And not all signals are equivalent. They are designed to exclude everyone with no risky activity from further analysis. All the warning signals for remaining candidates are scored based on a proprietary risk scoring model which gives us a prioritised shortlist of candidates to further investigate. The shortlist is then handed off the the Investigator Agent for a deeper analysis.
Stage 2: The Investigator Agent
A deep review of each candidate
For each candidate on the shortlist, an AI agent runs a structured investigation, much like a security analyst would. It pulls the user’s activity, checks it against their own history and their peers, writes draft findings, has them challenged by a second agent, and then publishes a report.
Below is a high level schematic of how the Investigator agent works. It has access to a prescribed list of data access and analysis tools which it uses to understand the actions of the candidate being investigated. This is then verified by an independent agent which tries to poke holes in the findings of the first one. The findings which survive the scrutiny are then published into the final report
Reaching a risk assessment
The goal of the investigator agent is to come up with an assessment of whether the candidate behaviour needs to be looked at by a SecOps analyst. There are two types of risky behaviours that we focus on: Bad Intent and Bad Habit.
Intent Is this malicious activity?
Habit Is this a careless routine?
Sensitive company data moved on purpose to a place the company does not control, usually somewhere new or at a sudden spike compared with the person's own history. More concerning if accompanied with departure signals.
Loss of control over sensitive data but likely not malicious, such as using a personal login for work tools. Worth fixing, but not a sign of theft.
The agent rolls up each finding into one of these categories and presents a unified view to the SecOps analyst of behaviour they need to take a look at. For each finding, we also provide evidence which backs the finding which they can verify in the forensics search page to convince themselves whether the behaviour is truly risky or if we made a mistake. The feedback provided via Escalate / Resolve buttons will be used to further tune the agent’s verdict judgement to be personalised for an organisation.
The way forward
Nightfall’s insider risk agents have been calibrated to detect any loss of control scenarios over sensitive data while keeping the false positives as low as possible. While this is a great starting point for us, we are continuing to improve our system along multiple dimensions which will make our agent assessments increasingly accurate over time. Some of the improvements we are actively working on are
- Destination Risk: Our app intelligence system provides a strong foundation for assessing destination risk. We’re enhancing it to reflect each customer’s sanctioned and unsanctioned apps and destinations, enabling more accurate differentiation between legitimate business activity and potentially risky data movement.
- Personalisation: While our system is designed to work well across our customers, we know there is no one size fits all definition of risk. We are building our risk system to be sensitive to business-specific contexts and user feedback.
- Stateful risk assessment: Our risk system current works on a “snapshot” of the data. But risky behaviour can accumulate over time. We plan to make our risk assessment stateful and provide a risk-over-time view to analysts.
- Data lineage informed risk scoring: We are also working on building a lineage graph of data on the endpoint which can help us identify deliberately obfuscated exfiltration attempts. This will feed into the scoring and assessment mechanism of our risk agents.
- Detector Improvements: Nightfall’s state-of-the-art detectors are the foundation of our Insider Risk system. As we continue to improve detection accuracy and deepen our understanding of document context, data ownership, and the relationship between users and the data they handle, those advances will directly strengthen assessments. We are also experimenting with lightweight detection at the endpoint. This combined with data lineage change, will enable us to do risk assessments in real time and block risky actions rather than just detect them.
At Nightfall we are committed to ensuring that we provide every leverage possible for security teams to stay on top of data exfiltration scenarios. Our Insider risk agents are a step in this direction and we look forward to making this a trusted tool for SecOps teams to detect and act on risky behaviour.
.svg)
.svg)
