@og From the standpoint of a SOC analyst, I swear the only difference between an admin and an insider threat sometimes is that the admin has a ticket number to cite for whatever it is they're doing.