Insider risk, investigated for you
Nightfall connects employee activity, sensitive content, and identity to surface the users who pose insider risk, and delivers a written case explaining what happened, why it matters, and what to do next.
The details change the conclusion
Detecting and acting on individual sensitive data movements is where DLP starts. User Risk Agents connect that activity over time and assess risk at the user level, where the real question lives.
A single event is a flag. A pattern across a person’s history, their team, and the business is an answer.
Whose tax return is it?
The employee’s own W-2 and a customer’s are the same detector hit. They are not the same risk.
Is that a personal account?
A share to a vendor and a share to a Gmail address look alike in a log. Identity resolves which one it was.
Is this unusual for them?
Three hundred downloads is a Tuesday for an analyst and an alarm for a recruiter. History sets the bar.
Is it unusual for the team?
If the whole department is doing it, it’s quarter-close. If one person is, it’s worth a look.
Two agents do the work. A verifier checks it.
Triage decides who deserves a closer look. Investigator builds the case. An evidence verifier challenges weak findings before anything is published.
Nothing is sent to the employee.
Cases go to security, not to the person under review.
Triage Agent
Scores every employee’s activity against their own history and company norms. Where data goes (competitor domains, personal accounts, AI services, job sites) and how it moves (download-then-send, funneled to one destination, off-hours, bursts vs. peers). Sensitivity from scanned content, role from identity, scripts told apart from people.
- Own history
- Company norms
- Destination risk
- Content sensitivity
> triage users=4,812 scored=4,812 high=9 critical=2 top=d.kim(94) noise_suppressed=98.7%
Investigator Agent
For High and Critical findings, reconstructs the timeline, inspects the content, and tests alternative explanations. Is this unusual for them? What happened, in what order? What data, and whose? Was it really them, or automation? How does it compare with peers?
- Timeline
- Content inspection
- Alternative explanations
- Peer comparison
> investigate user=d.kim events=14 span=72h alt_tested=[successor_handoff, device_swap] alt_supported=0
Evidence Verifier
Before anything is published, a verifier challenges weak findings. Thin evidence, a plausible benign explanation, or an unverified assumption sends the case back. What reaches your queue has already survived a second opinion.
- Second opinion
- Blocks weak cases
- Lists what’s missing
> verify case=IR-2291 evidence_items=14 sufficiency=PASS gaps=["device-level USB confirmation"] publish=true
The written case
A case for a validated high-risk user: what happened, why it matters, what to do next. Suspicious intent rated separately from risky habits, supporting events, a risk breakdown, and a workflow to escalate or close. Routed to Email, Slack, Teams, Jira, or SIEM/SOAR. Exportable as PDF.
- Intent vs. habit
- Risk breakdown
- Escalate or resolve
> publish case=IR-2291 status=NEEDS_REVIEW routed=[slack#secops, jira] employee_notified=false
Suspicious intent or risky habit. The case says which.
Each case distinguishes signs of suspicious intent from risky habits, with supporting events, a risk breakdown, and a workflow to escalate or resolve. Export as PDF for stakeholders. Route alerts to Email, Slack, Teams, Jira, or your SIEM/SOAR.
- Slack
- Teams
- Jira
- SIEM / SOAR
- PDF export
Available now for Nightfall customers
User Risk Agents are rolling out to customers in Early Access. Find it under Discovery → User Risk in the Nightfall Console, or ask your customer success manager to enable it.
Discovery → User Risk
Built into the console you already use. No new agent, no new deployment.
Human data movement
Coverage focuses on employee exfiltration across SaaS, endpoint, email, and browser. Agentic data movement is coming.
Shaped by real investigations
Watchlists, on-demand investigations, HRIS-enriched user context, and destination risk scoring are on the way. Early Access customers steer the roadmap.
See a case built end to end
Tell us a little about yourself and we’ll connect you with a Nightfall expert who can walk through User Risk Agents and answer any questions you have.
- A 30-minute call
- Tailored to your stack
