# AI-Driven IRM: Transforming insider risk management with adaptive scoring and LLM-based threat detection

arXiv: https://arxiv.org/abs/2505.03796 · HTML: https://mlsanity.com/paper/2505.03796/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 2 of its 23 references that are in the map.
- First posted on arXiv 1 May 2025.

## Builds on (most cited first, 2 of 2)

- [GPT-4 Technical Report](https://mlsanity.com/paper/2303.08774/) (2023)
- [Insider Detection using Deep Autoencoder and Variational Autoencoder Neural Networks](https://mlsanity.com/paper/2109.02568/) (2021)

## Built on by (most cited first, 1 of 1)

- [Role-Conditioned Refusals: Evaluating Access Control Reasoning in Large Language Models](https://mlsanity.com/paper/2510.07642/) (2025)

## Abstract (arXiv)

Insider threats pose a significant challenge to organizational security, often evading traditional rule-based detection systems due to their subtlety and contextual nature. This paper presents an AI-powered Insider Risk Management (IRM) system that integrates behavioral analytics, dynamic risk scoring, and real-time policy enforcement to detect and mitigate insider threats with high accuracy and adaptability. We introduce a hybrid scoring mechanism - transitioning from the static PRISM model to an adaptive AI-based model utilizing an autoencoder neural network trained on expert-annotated user activity data. Through iterative feedback loops and continuous learning, the system reduces false positives by 59% and improves true positive detection rates by 30%, demonstrating substantial gains in detection precision. Additionally, the platform scales efficiently, processing up to 10 million log events daily with sub-300ms query latency, and supports automated enforcement actions for policy violations, reducing manual intervention. The IRM system's deployment resulted in a 47% reduction in incident response times, highlighting its operational impact. Future enhancements include integrating explainable AI, federated learning, graph-based anomaly detection, and alignment with Zero Trust principles to further elevate its adaptability, transparency, and compliance-readiness. This work establishes a scalable and proactive framework for mitigating emerging insider risks in both on-premises and hybrid environments.