On designing computationally enhanced risk and crisis communications for insider threats

Abstract

Insider threats pose significant harm to organizations of all types. The financial costs for mitigating current and future insider threats increases in the millions of dollars each year. Furthermore, insider threat mitigation strategies often target malicious insiders despite the prevalence of inadvertent insider threats. To reduce costs while also targeting inadvertent insiders, organizations can develop and deploy risk and crisis communication (RCC) to better prepare employees against insider threats. RCC messages need to be developed and deployed effectively and efficiently. Effective messaging influences individuals to take protective actions against insider threats; efficient messaging involves swift message construction and delivery to impacted populations. While current RCC research specifies how to improve message efficacy and efficiency, much of RCC message development relies on time-consuming, laborious processes. These processes can be improved through the integration of computational text analysis and linguistic tools. I present a methodology on designing and developing computationally enhanced RCC for insider threats. I first conducted a systematic literature review (SLR) to discover any current use of computational tools to improve RCC message efficacy and development efficiency. Next, I performed content analysis on insider threat source text using a mixed methods approach. For this approach, I leveraged Natural Language Processing (NLP) techniques and tools--including the Large Language Model (LLM) ChatGPT--to process text using the Narrative Policy Framework (NPF) as the guiding theoretical framework. Lastly, I constructed insider threat risk messages using the content analysis results as message content and structure. These messages were constructed using a customized version of the LLM Llama specialized for RCC message construction. For both content analysis and message construction steps, I evaluated how well computational tools perform message development steps. Based on my evaluations, I determined the extent to which computational tools can replace humans in RCC message development, finding that the combination of human validation and computational analysis can lead efficient development of effective messaging. By creating effective RCC messages efficiently, impacted populations can swiftly take action against organizational insider threats.