There is no denying the fact that insider risks can pose as great a damage as other security threats like ransomware, phishing, and malware. Yet unlike these security threats where you can develop and operationalize globally optimized detections, insider risks detections present unique and complex challenges where understanding context and correlations is critical to ensure you have a successful insider risk management program. Having run the Insider Threat program at Microsoft we will be discussing the five primary principles that we have learned in our journey both internally and from our customers to help organizations understand what is required to build an effective insider risk program.