Explainable AI Analytics for Pre-Incident Insider Threat Risk Scoring in Information Systems
Main article
Abstract
Insider threats remain difficult to control because the most damaging events often emerge from ordinary access, changing work conditions, weak controls, and behavioral signals that are visible before a confirmed incident occurs. This study develops an explainable artificial intelligence analytics framework for pre-incident insider threat risk scoring in information systems. The framework integrates behavioral, organizational, and technical control indicators into a staged analytics pipeline that combines feature engineering, entropy-informed weighting, supervised learning, local explanation, calibration, and risk-tier governance. Instead of treating insider threat analytics as a black-box detection problem after malicious activity has already occurred, the proposed framework treats risk scoring as an auditable decision-support process for early intervention. A synthetic enterprise dataset is constructed to evaluate the approach across 6,000 user-period observations and 48 observable indicators representing access behavior, work context, policy violations, control exposure, and security-technology gaps. Comparative analysis shows that the explainable hybrid model improves AUC from 0.76 under entropy-only scoring to 0.89, while reducing calibration error to 0.08. Local explanation results identify data export volume, after-hours access, policy violations, managerial pressure, and data-control gaps as the most influential pre-incident signals. The findings demonstrate that explainable AI can increase model transparency, support proportionate governance actions, and improve the business usability of insider risk analytics without relying on intrusive surveillance or post-incident labels alone.
