Angara MTDR Launches New Service for Investigating Insider Cyber Incidents
The service is designed not only to quickly identify those responsible, but also to assess their actions from a legal standpoint.
When companies discuss information security, the focus is usually on protecting against external threats. But dishonest employees can cause just as much damage. Unlike outside attackers, they do not need to break into a network because they already have authorized access.
Damage From Insider Sabotage Can Accumulate Over Years
Russian cybersecurity company Angara MTDR is addressing this problem with a new service that enables businesses to investigate employee-related incidents quickly and at relatively low cost. Its experts identify not only the person responsible and anyone who helped them, but also provide an immediate legal assessment of their actions.
According to Angara MTDR representatives, insider incidents such as data theft, sabotage, fraud and covert work for competitors can be difficult to detect in time. The damage can accumulate over years because companies often attribute resulting losses to technical failures.
Detecting a violation, however, does not mean the problem has been solved. First, an investigation needs to begin as quickly as possible because digital evidence can disappear over time. Proving an employee's culpability in court is also extremely difficult. Standard event logs and data loss prevention (DLP) system reports are often insufficient to substantiate a company's case. These tools record information, but investigators must piece the fragments together, correlate them to reconstruct the full picture and support their findings with a legal assessment.
A Forensic Approach to Data
The new service is intended for cases in which a company suspects a data breach, discovers unauthorized copying of confidential information or identifies signs of fraud or abuse of authority.
Angara MTDR specialists collect data while preserving its integrity. More importantly, they reconstruct the user's activity across the system, tracing the sequence of actions down to the minute. They also carefully examine the company's internal documentation, including information-handling policies and written statements from those involved. Investigators then correlate these records with technical evidence from system logs, corporate email, network traffic and disk images.
At the next stage, experts assess the suspected offender's actions in terms of potential disciplinary, administrative and criminal liability. Once the investigation is complete, the client receives a package of documents that can be used in an internal inquiry or submitted to law enforcement agencies. The company also receives recommendations for addressing the underlying causes of the incident.
A Gradual Shift Toward AI
According to data published by SearchInform in March 2026, 51% of the Russian organizations surveyed had experienced personal data leaks in 2025. Employees were responsible for nearly half of those incidents.
Companies have been developing systems to combat insider misconduct for several years. In August 2023, MTS RED announced the launch of its Digital Forensics and Incident Response (DFIR) service. Digital investigations were among its areas of focus.
AI began to play a role in these processes soon afterward. In March 2024, STEP LOGIC announced the integration of a GPT assistant into its Security Data Lake platform. The tool is designed to help cybersecurity operations center analysts find events and analyze data related to incidents under investigation.
Meanwhile, insider sabotage has become a more pressing concern for businesses. In March 2025, Solar published an analysis of 230 incidents identified during pilot deployments of its Solar Dozor DLP system. The findings showed that eight out of 10 employees preparing to leave their jobs in the sample had attempted to take information assets they could access, including confidential data.
Angara MTDR's new service marks another step forward in digital forensics and the investigation of insider information security incidents. Bringing forensic analysts and legal experts together can significantly improve the chances of building a successful case against malicious insiders. For the IT industry, the service also points to further development of a service-based cybersecurity model in which customers acquire not only software tools, but also specialized expertise.
