Simulating Insider Cyber-Threat Risks: A Model-Based Case and a Case-Based Model
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
The growing reliance on technological infrastructures has made organizations increasingly vulnerable to threats from trusted employees, former employees, current or former contractors, and clients. Recent research indicates that successful defense from these threats depends on both technical and behavioral controls. In this paper, we report on our work to identify seemingly reasonable organizational actions that may inadvertently lead to increased risk exposure. We also consider how potential internal attackers may be encouraged or discouraged by monitoring the organization’s responses to probes of its firm’s security systems.
Two interwoven work products are presented: A case study that presents a particular type of insider threat–long-term fraud–and a simulation model that supports the case, the underlying dynamic theory, and examination of policy options. The case and model combine to produce a motivating and useful exercise that illustrates the problems of insider cyber-threats. This material has been used in teaching of insider threat issues with satisfactory results.
Cite This SEI Report
Rich, E., Martinez-Moyano, I., Conrad, P., Cappelli, D., Moore, A., Shimeall, T., Andersen, D., Gonzalez, J., Ellison, R., Lipson, H., Mundie, D., Sarriegui, J., Sawicka, A., Stewart, T., Torres, J., Weaver, E., & Wiik, J. (2005, August 11). Simulating Insider Cyber-Threat Risks: A Model-Based Case and a Case-Based Model. Retrieved August 19, 2026, from https://www.sei.cmu.edu/library/simulating-insider-cyber-threat-risks-a-model-based-case-and-a-case-based-model/.
@techreport{rich_2005,
author={Rich, Eliot and Martinez-Moyano, Ignacio and Conrad, Paul and Cappelli, Dawn and Moore, Andrew and Shimeall, Timothy and Andersen, David and Gonzalez, Jose and Ellison, Robert and Lipson, Howard and Mundie, David and Sarriegui, Jose and Sawicka, Agata and Stewart, Thomas and Torres, Jose and Weaver, Elise and Wiik, Johannes},
title={Simulating Insider Cyber-Threat Risks: A Model-Based Case and a Case-Based Model},
month={Aug},
year={2005},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/simulating-insider-cyber-threat-risks-a-model-based-case-and-a-case-based-model/},
note={Accessed: 2026-Aug-19}
}
Rich, Eliot, Ignacio Martinez-Moyano, Paul Conrad, Dawn Cappelli, Andrew Moore, Timothy Shimeall, David Andersen, Jose Gonzalez, Robert Ellison, Howard Lipson, David Mundie, Jose Sarriegui, Agata Sawicka, Thomas Stewart, Jose Torres, Elise Weaver, and Johannes Wiik. "Simulating Insider Cyber-Threat Risks: A Model-Based Case and a Case-Based Model." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, August 11, 2005. https://www.sei.cmu.edu/library/simulating-insider-cyber-threat-risks-a-model-based-case-and-a-case-based-model/.
E. Rich, I. Martinez-Moyano, P. Conrad, D. Cappelli, A. Moore, T. Shimeall, D. Andersen, J. Gonzalez, R. Ellison, H. Lipson, D. Mundie, J. Sarriegui, A. Sawicka, T. Stewart, J. Torres, E. Weaver, and J. Wiik, "Simulating Insider Cyber-Threat Risks: A Model-Based Case and a Case-Based Model," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 11-Aug-2005 [Online]. Available: https://www.sei.cmu.edu/library/simulating-insider-cyber-threat-risks-a-model-based-case-and-a-case-based-model/. [Accessed: 19-Aug-2026].
Rich, Eliot, Ignacio Martinez-Moyano, Paul Conrad, Dawn Cappelli, Andrew Moore, Timothy Shimeall, David Andersen, Jose Gonzalez, Robert Ellison, Howard Lipson, David Mundie, Jose Sarriegui, Agata Sawicka, Thomas Stewart, Jose Torres, Elise Weaver, and Johannes Wiik. "Simulating Insider Cyber-Threat Risks: A Model-Based Case and a Case-Based Model." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 11 Aug. 2005. https://www.sei.cmu.edu/library/simulating-insider-cyber-threat-risks-a-model-based-case-and-a-case-based-model/. Accessed 19 Aug. 2026.
Rich, Eliot; Martinez-Moyano, Ignacio; Conrad, Paul; Cappelli, Dawn; Moore, Andrew; Shimeall, Timothy; Andersen, David; Gonzalez, Jose ; Ellison, Robert; Lipson, Howard; Mundie, David; Sarriegui, Jose; Sawicka, Agata; Stewart, Thomas; Torres, Jose; Weaver, Elise; & Wiik, Johannes. Simulating Insider Cyber-Threat Risks: A Model-Based Case and a Case-Based Model. Software Engineering Institute. 2005. https://www.sei.cmu.edu/library/simulating-insider-cyber-threat-risks-a-model-based-case-and-a-case-based-model/