I have a confession to make. I am an insider threat.It’s true. I’m an insider threat. Have been my entire professional life. A hard pill to swallow, but there it is. It’s my truth. Thing is, if you’re reading this then it’s your truth, too. In fact, it’s true of anyone who has ever held a job. From those in the trenches to senior leaders, all the way up to the C-Suite, we all have what outsiders lack…authorized access. Whether it’s to spaces, data, systems, networks, or people, those on the inside are already over that first hurdle; the hardest one to bypass.We hear the word “threat” and think of bad guys w/ facial scars, in dark trench coats and sunglasses, skulking about back alleys waiting for their next victim. We don’t see ourselves as threats b/c, by-and-large, most of us go to work, do our jobs to the best of our abilities, take pride in what we do, and go on w/ life. In short, most of us aren't malicious threats to our employers. But, due to our placement, access, knowledge, and influence, there are plenty of chances for things to go sideways. A bad decision; poor business practices; poorly written policies; circumventing security controls, not to cause harm, but b/c those pesky obstacles designed to reduce the company’s risk exposure often hinder our abilities to take care of business timely and efficiently. That's not to say we should ignore external threats. In fact, sometimes malicious insiders have puppet masters guiding their actions. Nation states, hacktivist groups, even competitors, all know that it's easier to meet their goals if they have inside help. That's why disciplines such as cyber threat intelligence are so critical. If you don't know and understand your enemy's tactics, techniques, and procedures (TTP), it'll be difficult to know when you're dealing w/ more complex threats and where the gaps are in your defenses.I’ve spent almost two decades both responding to and looking for insider threat actors; those people whose decisions and actions create risk. I’ve learned to look past the technology to the people who use it in a way that opens organizations up to financial, reputational, operational, regulatory, and/or legal risks. I understand motivations, recognize potential risk indicators, and know how to differentiate between true bad guys and people who make bad decisions or fail to adhere to policy. I’ve been successful in helping to identify, mitigate and reduce risk.This is my passion.This is what I bring to the table. Email me at jsalston11@gmail.com.