Case file · Declassified summary
Insider-threat IP exfiltration disrupted before completion.
Embedded analyst flagged anomalous repository access correlated with personnel-risk indicators surfaced via TIMeR. Internal investigation followed within 24 hours.
- Client
- Sector
- National Security
- Region
- United States
- Duration
- 30-day window
- Status
- Closed
The situation
Conditions at day zero
A national-security contractor suspected an internal actor was exfiltrating sensitive IP. They had no behavioral baseline, no correlation across HR, repository and network data, and a window of approximately 30 days before contractual disclosure obligations.
- 01No behavioral baseline for the population at risk.
- 02HR, repository and network data lived in separate systems.
- 03Contractual disclosure obligations in roughly 30 days.
Subject risk score
Before
4/5
High
After
1/5
Low
Scored on TAM-C's 1 to 5 method. Contained once access was cut and IP recovered.
How it unfolded
6 entries · 30-day window
- Day 0
Embedded analyst on site
ActionA TAM-C analyst joins the client SOC and scopes the population at risk.
- Day 3
TIMeR program live
ActionPersonnel-risk indicators and repository telemetry feed one subject timeline.
- Day 9
Baseline established
ActionNormal access patterns are set per role, so deviation becomes measurable.
- Day 14
Anomaly detected in 37 min
SignalOff-hours bulk repository pulls correlate with Black Mirror exposure findings on one subject.
- Day 15
Investigation triggered
ActionThe client opens an internal investigation within 24 hours, with the ARGO NG timeline as evidence.
- Day 19
IP recovered
OutcomeAll identified IP is recovered before exfiltration completes. The actor is later prosecuted.
The data
Subject anomaly score versus role baseline
What TAM-C did
Approach
Embed inside the SOC
The analyst worked from within the client's SOC, with access to the signals that matter and the context to read them.
Correlate what was siloed
TIMeR tied repository access to personnel-risk indicators, and Black Mirror surfaced the subject's external exposure.
Make the pattern legible
ARGO NG's timeline view turned scattered events into one sequence the client's leadership could act on.
Products deployed
The outcome
Closed
Pattern detection latency was 37 minutes after the first anomalous action. The internal investigation triggered within 24 hours. 100% of identified IP was recovered before exfiltration completed. The actor was prosecuted.
| Measure | Before | After |
|---|---|---|
| Behavioral baseline | None | ▲Per role, day 9 |
| Data correlation | Three silos | ▲One subject timeline |
| Detection lag | Unknown | ▲37 minutes |
| IP outcome | At risk | ▲100% recovered |