Insider risk has a price tag. It only covers half the building.

Ask what an insider incident costs and there is an answer. Sector benchmarks put a single significant event between €500,000 and €5 million, once investigation, disruption, remediation, regulatory response and reputational cost are counted.

It is a usable figure. It is also, for most finance directors, an argument about something that has not happened, and they are right to discount it.

Meanwhile the quarter closes. Shrinkage sits slightly above the last one, not enough to trigger anything. A run of baggage exceptions and unclaimed items is logged and closed individually. A payroll run goes through with every rostered position marked filled.

All three are accepted as the cost of operating at scale. Some proportion of all three is insider activity, and nothing in the estate can say which proportion, because nothing connects those numbers to a person or a pattern.

That is the half of the building the price tag never reaches.

Four headings

Payroll for labour not delivered. Where rostered positions are recorded as filled by people who were not present, or were covered informally, the organisation pays for hours it did not receive and operates a security posture it does not actually have. Reconciling presence against roster turns that from an assumption into a monthly figure, and it is usually the first number a correlation layer produces.
Unattributed loss. Shrinkage, cargo discrepancies, baggage exceptions, operational disruption. Absorbed as a cost of doing business precisely because nothing links them to an individual. The same blind spot covers credentials that outlive a role, which stay invisible until an audit finds them.
Investigation hours. Reactive discovery means trawling several systems manually and reconstructing a timeline by hand. Where correlated records and an audit trail already exist, the same investigation takes a fraction of the time.
Elapsed time. The expensive one. Containment is consistently the costliest phase of an insider event, and the gradient between events resolved in weeks and those resolved in months is steep. Where discovery arrives through an audit finding, a police enquiry or a journalist, elapsed time is measured in months at best. The baggage tag scheme reported at Toronto Pearson in May 2026 had reportedly been running for around a year.

None of those four requires an incident to have happened. All four are running now.

Why the estate cannot produce the number

A capital request for a security system arrives at finance with a familiar shape: a threat, a gap, and a system to close it. Finance reasonably asks what happened to the last three systems bought to close gaps.

They all work, is the honest answer. Access control controls access. The video estate records. Rostering rosters. HR administers. Each performs its function competently. The difficulty is that each holds a fragment of a picture that only means anything assembled, and nothing in the estate assembles it.

Consider what an access control system genuinely reports: that an authorised credential was presented at a particular reader at a particular time, and entry was granted. Exactly what it was built to do.

What it cannot report is whether the holder was rostered for that shift, whether the zone relates to their role, whether their movement pattern has been shifting for months, or whether two colleagues on adjacent shifts show correlated changes of their own.

A reader is a gate. It grants or denies. Treating access logs as an insider detection capability is the most common category error in physical security, and an expensive one, because it produces the belief that the gap is already covered.

An access event outside a normal zone means nothing alone. A lapsed training record means nothing alone. A cluster of shift swaps means nothing alone. The same three facts, attached to one person, in the same six weeks, mean something.

The signal lives in the relationship between events, never in a single event.

How this gets funded

The first phase integrates access control and HR only. That is enough to establish an individual baseline for everyone in scope and to activate presence integrity and access rights assurance. Deliberately so: those two capabilities produce the payroll reconciliation and credential findings that carry a directly measurable return. The first phase is what makes the second straightforward to approve.

Rostering, training and incident data follow, then video and transaction correlation.

Prevented incidents are not a measurable quantity, and no serious case should be built on them. Four things adjacent to them are: variance between roster and presence, credential exceptions identified and closed, investigation hours per case, and elapsed time from first signal to intervention.

Baseline those before anything is deployed, and at twelve months there is an answer. That is a different position from the one most security investments leave you in.

Iveron. Predict. Detect. Protect. From insider threat.