Insider-risk templates
Overview
Section titled “Overview”Detect & respond → Cases → Insider risk lists detection templates built on the rule engine’s detections. Enabling one makes a detection rule from it. When the rule matches, it raises an alert, records a risk where the template says so, and opens a case, or adds the match to the case still open for the same rule and person.
| Template | What it looks for | Severity |
|---|---|---|
| Bulk data to a personal AI account | A person’s AI usage on a personal plan (Claude Pro or Max, ChatGPT Plus, Cursor Pro and similar) is three times their own daily usual | Critical |
| Repeated sensitive-data pastes | Five or more attempts in a day to send sensitive data to AI, whatever the guard did | Warning |
| Unapproved AI after a warning | A warning about an unapproved AI tool or model, then one used within a day | Warning |
| Unusual AI volume for a person | Token volume three standard deviations above the person’s last two weeks | Warning |
| Credentials pasted into AI | A credential, private key, API key or token caught on its way to AI | Critical |
Prerequisites
Section titled “Prerequisites”- To enable a template you need Configure the rule engine (
rule_engine.configure). Where the organisation requires approval for detection-rule changes, enabling waits for a second person. - The cases a template opens are worked with the cases permissions.
- The templates read guard decisions (from the browser extension, AI proxy, coding agents and SDK) and AI usage (from the endpoint collector).
Departing employees
Section titled “Departing employees”Shield360 does not read an HR system. The Bulk data to a personal AI account template watches everyone. To watch only people who are leaving, open the rule after enabling it and add a filter, or narrow its threshold.
Privacy
Section titled “Privacy”Matches are about people, so cases opened from them are pseudonymised until someone allowed to reveal them does. Alerts name the rule and counts, never the person.