The greatest challenge in identifying a threat is knowing what actions to be watching and which of them constitute a potential threat. With benign and threatening insider activity looking so similar, it’s no wonder it takes months to identify data breaches or fraud.