I work with a Microsoft partner company that serves enterprise clients. Clients are at risk from USB sticks and remote workers. Some people have privileged access to sensitive documents. With Insider Risk Management, you can track if someone attempts to copy a critical document to a USB stick, download something to their device, or send documents to their personal email accounts. Most of our customers pay a high amount for Microsoft enterprise licenses—more than a million dollars annually — so they want to get the full benefits of their licenses. Insider Risk Management is an excellent product that improves their security posture from the perspective of insider risks. It can take a long time to see the results, and most of the time, they are not given dynamically. It can take one or two days, but customers are happy to see the results. In Insider Risk Management, you can see which user was responsible this activity. They also have some eDiscovery teams and are happy to give their team some tests. They can create some eDiscovery cases to investigate the free feature alerts and actions. However, this can take weeks or months. The solution provides insight into user activity in Microsoft 365 products, such as Teams, Outlook, One Drive, etc. For example, it gives you alerts if a user downloads a file to their device, attempts to change the sensitivity label for a document, or tries to upload something to a third-party solution like Salesforce. With this solution, you can see all activity related to filename changes, sharing, etc. These insights are critical to a company's security because many attacks involve a hacker hijacking an employee's account to do something inside your company. This product creates more alerts for your security team. You can manage the alerts to reduce the noise because if you get dozens of alerts, it's hard to tell if something is dangerous or just normal activity. It takes time to create some useful policies. You can integrate Insider Risk Management with Microsoft Sentinel so that the alerts from risk management appear in Sentinel's live dashboard. It improves our threat response. It's more of a useful feature rather than one that saves a lot of time. We're generating thousands of alerts on the dashboards, which take time to adapt and understand, but many customers already use Insider Risk Management in their Sentinel dashboards. I don't have any data for this, but integration with Sentinel dashboards can save one or two hours because customers usually have some filters configured in Sentinel, so it's easier to find what you're looking for.
