Which of the following is NOT a common insider threat indicator?

• A. Unusual access patterns
• B. Unexplained data transfers
• C. Regular policy compliance
• D. Suspected collusion or sabotage

Answer: (C)

Insider threat indicators are signs that someone inside the organization might be acting in ways that could harm security or expose data. Unusual access patterns, such as logging in at odd hours or reaching systems or data beyond what their role requires, signal potential risk. Unexplained data transfers, especially large or frequent transfers to external destinations, are classic red flags that data could be leaking or being exfiltrated. Suspected collusion or sabotage points to coordinated or intentional harm by insiders.

Regular policy compliance, on the other hand, is what you’d expect from a legitimate user who is following rules and procedures. It doesn’t raise security concerns the way the other examples do. So it’s the indicator that does not fit with insider-threat signals, making it the best choice here.