The New Finance VP and the 92 Risk Score
Helio Systems is a 5,000-employee SaaS company using Exabeam UEBA for insider-risk scoring. A VP of Finance who joined 11 days ago triggers a risk score of 92 after downloading 14 GB from SharePoint, opening 1,100 files, and logging in at 02:10 local time from her home city. Her peer group is all Finance users with n=85, whose median is 140 files and 600 MB per week. She also consented to a new OAuth app that requests read access to all SharePoint sites. The VP is leading a confidential acquisition workstream and has been asked by the CFO to assemble a data room before a board meeting. Her manager says the activity is expected, but the Exabeam case has no onboarding context, and the vendor baseline for new hires is only 10 days. The SOC must decide whether to escalate to HR or legal, close as benign, or keep investigating, while the board meeting is in 48 hours.
1. How should the analyst interpret the 92 score given the peer group and the VP's tenure?
Read the worked answer
The 92 is a useful trigger but not a probability of malice. The score is inflated by two model inputs: a cold-start baseline of only 10 days and a peer group that includes 85 finance users but not executives leading M&A. A VP legitimately handles far more documents than an AP clerk, so volume and file-count anomalies are expected. The 02:10 login is only anomalous if her normal pattern is 08:00-18:00; a new hire has little history, so the model may over-weight the first late login. The OAuth consent is a real risk signal because it grants broad read access, but consent by a VP for a board project can be legitimate. The correct reasoning is to separate model confidence from case severity: high score, low confidence due to tenure and peer mismatch. Do not close as benign based on manager assurance alone, and do not escalate to HR or legal on score alone. Treat it as an investigation with a 48-hour deadline, prioritize the OAuth app scope and the data classification of the 1,100 files, and document that the score was not used as the sole basis.
2. What context and evidence would separate authorized M&A work from insider data theft?
Read the worked answer
Test four things. First, authorization: did the CFO or deal team approve her access to the acquisition data room, and is the OAuth app approved by IT and security? A legitimate M&A workstream should have a project code, a data-room access list, and a documented business owner. Second, data scope: are the 1,100 files within the deal folder, or do they include unrelated HR, source code, or customer contracts? File-path and sensitivity analysis matters more than volume. Third, exfiltration: did the 14 GB leave the tenant via download, sync client, personal email, or the OAuth app? Check SharePoint audit logs, DLP, endpoint USB and cloud sync, and mail flow. Fourth, timing and concealment: 02:10 is not inherently malicious for a global deal, but deletion of logs, use of personal accounts, or renaming archives would change the assessment. Interview the manager with specific questions, not general reassurance. If the OAuth app is unapproved, revoke the token pending review. Preserve logs before any confrontation. Escalate to legal only if data scope or exfiltration is outside the authorized project.
3. How would you tune the model without creating a blind spot for new executives?
Read the worked answer
Add context, not a blanket exclusion. Create a peer cohort for executives and M&A users based on role and data-access entitlements, and require a minimum 30-day baseline before volume anomalies are weighted heavily. For new hires, use an onboarding watchlist that raises review but lowers automated severity until the baseline matures. Add an approved-project context tag for the data room, with an expiry date, so access inside that project is scored lower while access outside it remains high. Do not whitelist the user or the OAuth app; keep OAuth consent as a separate risk rule for all users. Add a rule for downloads to unmanaged devices and for first-time OAuth grants with tenant-wide read scope. Measure the change: after 30 days, compare false-positive rate for executives and detection rate on a red-team test where a finance user downloads unrelated files. If the watchlist suppresses all alerts for new executives, it is too broad. Document the tuning rationale and get business owner sign-off.