The Coverage Cost of Every Rule You Have Not Written Yet
Static rules miss most insider incidents because they can't catch what nobody anticipated.
A rule-based DLP program can only stop the threats someone already thought to write down. Every category of risk that hasn't been defined yet is a permanent blind spot, not a temporary gap the team will close next quarter. This is the structural premise behind any serious evaluation of modern data loss prevention: the mechanism of a static rule is to check an event against a pre-written condition, and if that condition was never written, the event passes through unflagged, unqueued, uncounted. It doesn't register as a miss because the system has no category for it. That's a different failure mode than an analyst missing an alert buried in a queue, and it's a more permanent one.
This isn't a staffing problem. A rule describes last year's exfiltration method, so it cannot, by definition, describe a method that didn't exist when the rule was drafted. A program's dashboard can show green across every rule that fires while the actual scope of what's being watched stays narrower than anyone realizes. Leadership sees a clean console and reads it as coverage, when it's really a record of what someone anticipated correctly in the past.
That's a response to the fact that a rule tied to one channel says nothing about behavior on any other channel, rather than a stylistic preference for more data sources, and the channels keep multiplying faster than anyone can write rules for them.
How risk migrates faster than rulesets can follow
The threat surface moves faster than policy cycles can track it, and the lag between a new behavior appearing and a rule catching up to it is the exact window in which incidents happen. Rules are written against the channels and behaviors that exist at the moment someone sits down to write them. Once behavior shifts to a new channel, the rule stays anchored to the old one, still enforcing a boundary nobody is testing anymore.
The migration itself rarely announces itself. No alert fires and no anomaly surfaces in a security team's monitoring, because the new channel simply has no rule attached to it yet, and a security team has no reliable way to know what it isn't seeing. Departing employees make the exfiltration timing concrete: data-movement behavior often changes weeks before a resignation is announced, but a rule tuned to catch bulk downloads in an employee's final two weeks will miss the slower, earlier exfiltration that happened well before anyone suspected a departure was coming.
The clearest large-scale example of this migration is generative AI. Employees started pasting sensitive data into public AI tools the moment they had access to them, well before any enterprise policy had been written to address the behavior at all. Samsung's experience with this wasn't an isolated incident. It established a pattern that subsequent telemetry confirmed across many organizations: employees submit sensitive data to AI tools whenever the work makes it relevant, regardless of whether a rule exists prohibiting it. No one trained a workforce to treat a chatbot as an exfiltration risk, so no one behaved as though it were one, and the rule-writing process was always going to arrive after the behavior had already become routine. A security team writing rules today is, structurally, still responding to last quarter's threat.
The population of insiders that static rules were never designed to see
Most insider incidents aren't the work of a deliberate adversary carefully evading detection. They come from negligent employees, compromised accounts, and ordinary workers adopting new tools, none of whom trip a rule because their behavior was never classified as prohibited in the first place. Data from 2026 insider threat research puts negligent or careless insiders at 53% of all incidents, with malicious insiders and credential theft accounting for the rest. A system built to catch outliers is aimed at the wrong population when the majority of risk comes from people doing ordinary work in ways security never modeled.
Vectra AI's insider risk management guide frames the distinction well: insider threat is arson, but insider risk is every way a building can catch fire, including a frayed cable nobody noticed. A program built only to catch arsonists will never see the frayed cable, and the frayed cable is where most of the incidents actually originate. Static rules are, by construction, arson detectors. They look for the deliberate, the flagrant, the pattern someone sat down and anticipated. They have nothing to say about the employee who genuinely didn't know a file was sensitive, or the account that behaved exactly as it should have until the moment it didn't.
The rise of non-human identities makes the gap wider still. Service accounts and AI agents now hold standing privilege and can act autonomously inside enterprise systems, and no rule was ever written for what an AI agent acting on a user's behalf is supposed to look like when it starts behaving strangely. Compromised accounts present the hardest case of all for a rules-based system, because in most log data a legitimate employee exfiltrating files before departure looks the same as an attacker operating on stolen credentials. Both are working inside authorized systems with valid credentials, and no rule checking for authorization failure will ever catch either one. Behavioral platforms like Candor replace static rule evaluation with multi-source behavioral profiling, surfacing risk patterns based on who is acting, what they're accessing, and the context surrounding that activity, rather than waiting for someone to anticipate the next threat and write it down first.
What unwritten rules cost over time
The cost of an unwritten rule doesn't appear as a line item anyone can point to. It accumulates in containment time, because every day an incident sits undetected inside a blind spot is another day the damage compounds. Incidents still take weeks to contain on average; that's an improvement over prior years, but it's still a long window of exposure before a team even begins to act. Incidents that drag on past that average cost meaningfully more, and the ones that stretch into the longest containment tier carry the highest costs of all, a gap driven almost entirely by how long the incident lived inside a blind spot nobody was watching. The Ponemon data behind this puts a specific number on how rare fast containment actually is: only 13 percent of incidents were contained in under 30 days. Most organizations are absorbing costs well above the low end of the curve, not near it.
The per-incident cost breakdown from 2026 enterprise insider threat data backs this up directly: containment is the single largest cost component, ahead of investigation and ahead of remediation. The expense lives in the delay, not in the response once the team finally engages. Indirect costs stack on top of that delay. Regulatory exposure, litigation, reputational damage, and lost productivity all scale with how long an incident goes unnoticed, not with how severe the original act was.
The obvious objection is that better rules would shorten containment time, but that objection misreads the mechanism. A rule cannot be written for behavior nobody has observed yet, and by the time the behavior has been observed closely enough to write a rule for it, the incident is already underway. Shortening containment requires a different kind of detection entirely, one that doesn't depend on having already catalogued the exact pattern it needs to find.
How behavioral detection closes the gap rules leave open
Behavioral detection doesn't check whether an action matches a prohibited pattern. It checks whether the action fits the context of the person, the data involved, and the surrounding timeline. That lets it surface risk that no one ever wrote a rule for. A rule fires when a fixed condition is met, while a behavioral system fires when the full set of signals, who, what, where, when, and how, deviates from what the surrounding context would predict.
That difference is what lets behavioral detection catch the negligent employee whose action was never technically prohibited, the compromised account whose credentials are entirely valid, and the slow-moving malicious insider who never crosses any single-event threshold a rule could catch. Insider risk guidance confirms the design logic here: modern programs layer behavioral analytics over identity and data signals so that one anomalous action, a privileged account suddenly exporting bulk records to cloud storage, becomes a single prioritized signal instead of three unrelated alerts an analyst has to piece together manually.
This same principle governs behavioral platforms generally: understanding both the data and the person involved, what the information actually means, where it's heading, who's interacting with it, and the pattern of activity around it, lets risk appear through context. That design lets Candor trace exfiltration patterns across a user's full timeline, not just at the single moment an event happens to get flagged. Shadow AI use, where employees move sensitive data into generative AI tools through personal accounts, is a category Candor's controls address by weighing the data itself, its destination, who owns the account, and the surrounding context before intervening, rather than issuing a blanket block or simply watching and logging.
The strongest challenge to any behavioral detection claim comes from research on alert fatigue. Tariq et al., writing in ACM Computing Surveys in a paper titled "Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities," found that security professionals are overwhelmed by high alert volumes, producing cognitive overload and desensitization that human-AI collaboration and intelligent triage are needed to address. What's missing from most behavioral systems is a formal, auditable feedback loop that translates what analysts actually decide back into how the model tunes itself, without quietly teaching the system to suppress the very signals it should be raising. Explainability and auditability are the mechanism that keeps a behavioral model from becoming a second black-box blind spot in place of the first one. A system that fires correctly but can't show an analyst why is no more trustworthy than a rule nobody wrote.
How the alert queue becomes its own blind spot
A detection system that surfaces the right signal but routes it into an overloaded queue has not closed the blind spot. It has simply moved the blind spot from the rule layer to the analyst layer, and the coverage cost stays the same either way. CrowdStrike's 2026 Global Threat Report documents how fast attackers move from initial access to lateral movement once inside a network, with the fastest recorded cases measured in seconds. If a security team averages more than 30 minutes per investigation, it is running at human speed against an adversary operating at machine speed.
An alert that gets generated but sits uninvestigated past that adversarial window functions, in practice, as an alert that was never generated at all. The coverage cost is identical whether the gap came from a missing rule or from a queue nobody got to in time. Cutting the time it takes to investigate an alert matters as much as the accuracy of the detection that produced it. This is a place where Candor's platform is built to contribute directly: it assembles the full story around an event before that event ever becomes a human alert, so an analyst arrives at a verdict already in hand rather than starting an investigation from a blank page. Negligent employees and compromised accounts operate inside authorized access and never match the profile of an obvious malicious outlier, so rule-based detection misses most insider incidents by design. Behavioral platforms that establish a baseline of normal activity for each individual, and surface deviations in how that person handles data regardless of whether the account looks legitimate on paper, catch the cases static rules were never built to see.
What a program beyond its own rules requires
Closing the unwritten-rule blind spot doesn't come from writing better rules. It comes from a different architecture altogether, one that classifies what data actually matters to the business, monitors behavior across every path data can leave through, and investigates signals before they ever reach a human analyst. Vectra AI's insider risk management guide lays out a lifecycle for what a working program actually does: classify the data that matters most, not by a regex pattern or a label but by what that data means to the business; reduce unnecessary standing access, including for non-human identities and service accounts; monitor behavior across every exit path, web, email, endpoint, and SaaS, not just the paths where rules happen to exist already; assess the intent and context behind an anomaly instead of treating every flagged event as an automatic verdict; and respond, contain, and feed the lessons from each incident back into the program in a way that's auditable and can't quietly be gamed over time.
Governance has to come before tooling. If an organization buys a monitoring platform before it has classified its sensitive data, set its risk appetite, and decided who actually responds to an incident, the program ends up generating noise. That sequencing problem connects directly to the fact that a company's most valuable data frequently carries no classification label at all, because its sensitivity comes from what it means to the business rather than from whether it happens to match a predefined pattern. A program that depends entirely on labels will miss exactly the crown jewels that were never labeled in the first place.
The financial case for closing this gap is substantial. Organizations with formal insider risk programs avoid meaningfully more incidents per year and save $8.2 million annually in breach costs compared to organizations without one, a payoff large enough to justify the governance work on its own. Candor Security's architecture reflects this full lifecycle rather than a single piece of it: the platform combines behavioral DLP with insider risk detection across enterprise systems, understanding the data and the person involved in the same decision, so it doesn't need a rule to have already been written for a threat before it can surface that threat. Its shadow AI coverage depends on the data, the destination, who owns the account, and the surrounding context, intervening before sensitive data actually leaves rather than issuing a blanket ban or watching passively from the sidelines. Its investigation workflow has AI examine candidate events before they ever reach a human alert queue, cutting the burden that turns a correct detection into a coverage failure anyway. And its emphasis on explainability directly answers the earlier concern about trusting an adversarial baseline: a behavioral system is only as trustworthy as an analyst's ability to see why it fired, and why, on any given day, it didn't.
