The insider threat is not really a cybersecurity problem or a data analytics issue; it's a human risk problem that can only be solved by understanding how people think and behave.
The Disgruntled Departing Employee (Saboteur)
This employee can be introverted and extremely detail-oriented. She may feel underappreciated and overlooked by management, causing her to become frustrated and careless about her work. You might notice her openly searching for a new job during work hours. As a result, she may have a huge fight with her boss and quit, leaving a "time bomb" program that will go off months after her departure, wiping important records and replacing them with important transactions.
Indicators: Seeks access to servers outside normal business hours. Analysis of communications often reveals dissatisfaction with rules. Minor rules violations may be indicative of greater problems.