Insider threat investigation labs, one case at a time
Insider investigations ask different questions from intrusion cases. The suspect already had access, so the examiner has to prove intent and movement: which records were opened and when, what left on a USB drive, what was texted or pasted somewhere it shouldn't have been, what was exported and where it went, and who else was involved.
This pathway runs through the common insider patterns one at a time, each as a complete case with a report to write: a records-access complaint, a departing engineer's workstation, a pricing leak on a phone, a DLP alert on an AI assistant and a customer export. The capstone follows one suspect across five evidence sources and asks for the full story, not one artifact.
6 cases · ~14 h 9 min of lab time · Medium to Expert · a different variant for everyone · verified answer keys
The pathway, in order
6 cases, about 14 h 9 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
Need to Know (Snooping: Unauthorized Record Access)
Logon, browser and disk evidence on a records-access complaint.
MEDIUM~1 h 10 minUp to 20 questions -
02
Paper Trail (Insider Data Theft via USB)
Removable-media artifacts on a departing engineer's workstation.
MEDIUM~1 h 50 minUp to 20 questions -
03
Open Secret (Texting Secrets to a Competitor)
Phone evidence on a pricing-leak complaint.
MEDIUM~1 h 10 minUp to 20 questions -
04
Loose Lips (Insider Data Leak via AI Assistant)
Browser, disk and mail evidence behind a DLP alert.
MEDIUM~1 h 15 minUp to 20 questions -
05
Two Weeks' Notice (The Customer Export)
Track where a customer export went.
MEDIUM~1 h 20 minUp to 20 questions -
06
Inside Job (Insider and Collusion)
Capstone: one suspect across five evidence sources.
EXPERT~7 h 24 minUp to 30 questions
What this pathway covers
Who it's for
- Corporate investigators and HR-adjacent security staff who handle policy violations and need defensible, repeatable findings.
- Instructors teaching an insider-threat or ethics unit who want realistic cases without a nation-state actor.
- Candidates preparing for employment-law or e-discovery work who need practice with the evidence before the deposition.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
Windows Forensics (GCFE)
Registry, execution, USB, browser and event-log analysis on a Windows host, from first look to a full intrusion.
10 cases · ~17 h 57 min · GIAC GCFE
Mobile Forensics (GASF)
Messages, app data, deleted records and device activity from mobile extractions.
8 cases · ~16 h 27 min · GIAC GASF
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.