Above Security and Forscie Launch the Synthetic Insider Threat Matrix

Above Security(opens in new tab) (Above), the AI-native managed insider threat platform, today launched the Synthetic Insider Threat Matrix (SITM), the new extension of the Insider Threat Matrix(opens in new tab)™ (ITM) focused entirely on the agentic workforce. The ITM is a free, vendor-neutral taxonomy created and stewarded by Forscie that has become the security industry’s reference standard for how insiders cause harm. Above has served as the ITM’s inaugural sponsor since early 2026, and the SITM is the next chapter of that partnership. Built by researchers at Above Theory (opens in new tab) alongside Forscie’s team, the SITM extends the ITM’s model to cover a new class of insider — the synthetic one.

Also Read: IT Tech Pulse Exclusive Interview with Ken Claffey Chief Executive Officer and President of VDURA

Above Theory built the categories in the Synthetic Insider Threat Matrix and contributed deep insights grounded in real-world agent behavior, working in conjunction with Forscie to map every synthetic-insider tactic cleanly onto corresponding techniques in the original, human-centric ITM. Above Theory’s research, drawn from what Above’s investigative agents see across live customer environments, confirms what the data suggests: synthetic insiders are already producing the kind of behavior security, legal, and HR teams have spent decades learning to investigate in people — and almost nobody had a shared language to address it before today. The SITM maps 166 knowledge objects covering detection and prevention techniques specific to agentic incidents, including unauthorized data access, autonomous exfiltration, privilege misuse, and shadow AI activity.

For the security community, the SITM provides three concrete tactical benefits:

• A common language for describing synthetic-insider behavior instead of ad hoc terminology.
• A structured framework to map that behavior against, so techniques can be compared and referenced consistently across organizations — the same role MITRE ATT&CK plays for external attackers.
• A shared basis for writing investigation reports that use terms any analyst would recognize immediately.

An estimated(opens in new tab) (opens in new tab)28.6 million AI agents were active inside enterprises in 2025 — a number projected to surpass 2.2 billion by 2030. Many AI agents hold standing access to sensitive information found in various sources, including CRM records, source code, and finance systems. Each has the capacity to act thousands of times a day without a shift change. Yet, unlike human insiders, none of them were interviewed, onboarded, or assigned a manager.

“Synthetic insiders are a real and growing problem, and most of the industry doesn’t yet know what to do about it,” said Aviv Nahum, Co-Founder and CEO of Above Security. “We do, because our research team has been studying this behavior in live environments for months. Extending the Matrix, so the whole community has language for it, is exactly what security teams and the industry as a whole need right now.”

Also Read: IT Tech Pulse Exclusive Interview with Syed Ali Founder and Chief Executive Officer of EZO

“Insider risk practitioners have always needed a shared, vendor-neutral language to describe how harm actually occurs inside an organization,” said James Weston, founder of Forscie and co-creator of the Insider Threat Matrix. “Advances in AI present a unique challenge to insider risk programs that does not neatly fit into the existing human-centred paradigm. To address this, we worked with Above Theory to create the Synthetic Insider Threat Matrix, like the MITRE Corporation did with the MITRE ATT&CK framework over a decade ago.”

Write to us [⁠wasim.a@demandmediaagency.com] to learn more about our exclusive editorial packages and programmes.