“In every insider threat case, there is a combination of network activity and employee behaviour. The malicious activity crosses both physical and electronic modalities…”