Real sources live here, separate from the fictional roster. Profiles are invented; these links are not. We summarise; read the originals.
Guidanceprimary-source
CISA
CISA's mitigation model combines organizational, personnel, physical and information security; risk assessment uses observable behavior and context.
Guidanceprimary-source
Carnegie Mellon SEI / CERT
The 2022 guide describes 22 practices informed by analysis of more than 3,000 cases, including coordinated enterprise controls such as separation of duties, least privilege and deprovisioning.
Guidanceprimary-source
CISA & FBI
Joint advisory describing impersonation of staff and help desks, MFA fatigue and reset abuse. External impersonation must not be mislabelled as proven malicious insider behaviour.
Guidanceprimary-source
Microsoft Learn
Templates contextualise data movement near departure dates and support HR-driven signals; alerts require review rather than automatic conclusions.
Guidanceprimary-source
Microsoft Learn
Pseudonymisation is on by default for specific analyst and investigator roles, supporting privacy during review. Risk signals are not verdicts.
Guidance
CISA
Guidance
NIST
Guidance
MITRE ATT&CK
Guidance
MITRE ATT&CK
Guidance
MITRE ATT&CK
Guidance
MITRE ATT&CK
Guidance
MITRE ATT&CK
Incidentprimary-source
Coinbase (primary disclosure)
Coinbase reported criminals bribing overseas support personnel to obtain customer data for later social engineering. Its disclosure distinguishes exposed data from passwords, private keys and access to funds.
Incidentprimary-source
KnowBe4 (primary disclosure)
A hire using a stolen identity and altered photo was detected and contained by endpoint controls and restricted onboarding access. KnowBe4 explicitly said no data was lost or exfiltrated — this was not a successful breach.
Incidentdeveloping-attributed-reporting
Reuters
Developing reporting of a roughly $6.3B theft disclosed 29 Oct 2026. Preliminary company statements cite a compromised engineer laptop; later reporting mentions additional breach points. Compromised infrastructure is not evidence of a malicious employee.
Developing and attributed — not independently verified. Compromised infrastructure is not evidence of employee intent.
Incidentdeveloping-attributed-analysis
TRM Labs
TRM assesses hot-wallet signing-infrastructure compromise from transaction evidence and attributes it to TraderTraitor with high confidence. Root cause was not yet publicly established. An attributed assessment, not a finding about any employee.
Developing and attributed — not independently verified. Compromised infrastructure is not evidence of employee intent.
Culture · anecdote, not evidencecultural-reference-not-evidence
Alex Blechman (original post)
The product premise in one joke: institutions reading a cautionary tale as a spec. Linked and credited; InsidrMet copy is original.
Culture, not evidence. Linked and credited; nothing reproduced.
Culture · anecdote, not evidencecultural-reference-not-evidence
Randall Munroe / xkcd
Expensive technical assurance vs human exposure. Linked only, not reproduced.
Culture, not evidence. Linked and credited; nothing reproduced.
Culture · anecdote, not evidencecultural-reference-not-evidence
K.C. Green / Gunshow
Institutional normalisation of obvious warnings. Original artwork credited and linked; we don't reuse it.
Culture, not evidence. Linked and credited; nothing reproduced.
Culture · anecdote, not evidencediscussion-excerpt-only
r/sysadmin community
Public discussion of admins being both defenders and privileged risk. Only a search excerpt was reviewed (full retrieval blocked). Discussion, not corroboration; not quoted.
Culture, not evidence. Linked and credited; nothing reproduced.
The ByPants Exchange scenario is a generic, synthetic signing-infrastructure exercise with an original trousers brand. It is prompted by developing reporting (Reuters, TRM Labs — listed above as incident sources) on a real exchange incident. Those are attributed, developing assessments: compromised infrastructure or a compromised device is not evidence that any employee acted maliciously. We publish no counts of real staff or pre-disclosure figures. A signature tells you which key. It does not tell you whose hands.
Checking roster… · 50 fictional profiles