Insider Threat - They are real, and they will eventually cause an incident in every organization. Proper preparation, training, and vigilance can prevent or mitigate related negative consequences. The focus is generally on Detection , what about Prevention/ response?

• First, we should ensure all employees understand organizational policies regarding use of information resources and workplace behaviour. Second, any policy violation should result in a quick response by management. The response should match the level of the offense. Further, every employee, without exception, should understand the consequences
• 
  
• Terminating an employee is one way to deal with a potential problem. However, we often value employees who are simply going through rough personal times. Further, termination without prior efforts to resolve issues can result in litigation. It is often better to remediate than quickly terminate.

https://www.hackread.com/managing-insider-threats-with-internal-monitoring/