> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/getting-started/use-cases/insider-risk-management.md). # Insider risk management ## Industry challenge Insiders constantly expose sensitive data in SaaS applications. Exposure can be accidental, like when insiders share encryption keys, or intentional, by departing employees who steal organizational data. HR and security platforms are often disconnected, and this increases the likelihood of sensitive information leaving with a departed employee. For example: * When HR managers initiate employment status changes for departing employees, security teams should be made aware so they can closely monitor these high-risk individuals. * Employees who are terminated or made redundant increases insider threat risk and the propensity for sensitive data exfiltration. ## DoControl solution DoControl helps your organization prevent data leakage and insider threat with effective insider risk management. {% embed url="" %} ### User behavior monitoring DoControl’s AI-powered threat detection and DLP mechanisms identify insider threats in real time and respond immediately, either on-demand or with predefined workflows. When employment status changes are triggered, DoControl initiates workflows in real-time to block file sharing. DoControl also prevents departing employees from exfiltrating data stored in SaaS applications; for example, if an employee emails sensitive files to personal email accounts. ### Business context enrichment Distinguish between normal user behavior and actual insider threats. DoControl contextualizes each potential threat with user metadata from your IdP, HRIS, and EDR, and automatically engages with the user when additional context is needed. {% hint style="success" %} The list of departing and terminated employees is continually synced with HRIS (HiBob and Workday). {% endhint %}

Selecting terminated employees for an automated security workflow

### End-user education Heighten end users' awareness of security policies to prevent negligence. DoControl promotes real-time education for true insider risk management. When users violate SaaS security policies, they are promptly notified via email or Slack and asked to remediate. ![Alert notification to Slack](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FKvMr11Ib3YqMcAN8Nozm%2Falert%20notification%20to%20Slack.png?alt=media\&token=7317bfb8-5bb2-4e80-8ae8-14a6283f5689) {% hint style="success" %} Learn about about Insider risk management with DoControl's [Identities](/docontrol-user-guide/risk-management/identities.md) solution. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/getting-started/use-cases/insider-risk-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.