Above Security, Forscie launch Synthetic Insider Threat Matrix

Above Security and Forscie on Aug. 27 announced the Synthetic Insider Threat Matrix, a free extension of the Insider Threat Matrix designed to help security teams classify synthetic insider risks tied to agentic AI.

The companies say the framework gives teams a shared way to investigate and compare incidents involving AI agents using the same approach they applied to human insider behavior.

What the matrix covers

According to the release, the Synthetic Insider Threat Matrix, or SITM, was built by researchers at Above Theory with Forscie’s team. The companies say it maps synthetic insider tactics onto the original human-centric Insider Threat Matrix, which Forscie created and stewards as a free, vendor-neutral taxonomy.

The release says the SITM includes 166 knowledge objects and adds detection and prevention techniques for unauthorized data access, autonomous exfiltration, privilege misuse and shadow AI activity. It also says the matrix is live at insiderthreatmatrix.org and is free to reference regardless of platform.

Above said its customers’ investigations already map directly to SITM and ITM categories inside the Above portal. The release says Above has been the Insider Threat Matrix’s inaugural sponsor since early 2026.

Background and context

The announcement frames the work around what Above calls the “agentic workforce.” The release says an estimated 28.6 million AI agents were active inside enterprises in 2025 and projects that figure will exceed 2.2 billion by 2030. It also says many of those agents hold standing access to sensitive information, including CRM records, source code and finance systems.

Above recently announced a strategic investment from the CrowdStrike Falcon Fund, according to the release.

What the companies said

Above CEO Aviv Nahum said synthetic insiders are “a real and growing problem,” and said the company’s research team has been studying the behavior in live environments for months, according to the release.

Forscie founder James Weston said insider risk practitioners need a shared, vendor-neutral language for how harm occurs inside organizations. He compared the work to the MITRE ATT&CK framework, the release said.

What happens next

The release does not say whether the companies plan additional updates to the matrix. It does say the framework is now public at insiderthreatmatrix.org and that Above customers can already map investigations to the new and existing categories in the Above portal.

Sources

• PR Newswire release: Above Security and Forscie launch the Synthetic Insider Threat Matrix

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.