Evaluating Presence and Use of Suicide Risk Indicators in Insider Threat Data
In 2024/2025, MITRE conducted a rigorous applied research study to determine whether and how User Activity Monitoring (UAM) data commonly collected by Insider Risk and Threat Programs contains enough ‘signal’ to provide early risk indicators of suicide. We are excited to share our completed analyses and findings with the community. In 9 months, MITRE’s insider risk/threat behavioral sciences and data sciences researchers processed and analyzed extensive, real-world UAM data collected for 46 US Government (USG) employees who tragically died by suicide between 2017 and 2024. We compared the UAM data for those employees to an equal matched control sample of USG employees with no indication of suicide risk. Our analyses included qualitative hand annotation of over 1 million lines of keyboard data (3.3 million words), and application of computational analyses such as sentiment analysis and natural language processing. The analyses identified both data-driven opportunities and limitations in how UAM can proactively identify suicide risk in the workforce. We will also share an additional unexpected resource developed during the work, specifically an insider risk/threat analyst template for suicide referrals or after-action evaluations following a death by suicide. By emphasizing observable behaviors and addressing practical limitations, this new research is equipping Insider Risk and Threat Programs with actionable strategies to improve suicide risk detection and response.