{"id":"https://openalex.org/W7130643252","doi":"https://doi.org/10.1145/3798089","title":"Integrating Human Factors into Insider Threat Detection \u2013 A Systematic Review","display_name":"Integrating Human Factors into Insider Threat Detection \u2013 A Systematic Review","publication_year":2026,"publication_date":"2026-02-20","ids":{"openalex":"https://openalex.org/W7130643252","doi":"https://doi.org/10.1145/3798089"},"language":"en","primary_location":{"id":"doi:10.1145/3798089","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3798089","pdf_url":null,"source":{"id":"https://openalex.org/S157921468","display_name":"ACM Computing Surveys","issn_l":"0360-0300","issn":["0360-0300","1557-7341"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Computing Surveys","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Nadeeka Pathirana","orcid":"https://orcid.org/0009-0000-0750-9991"},"institutions":[{"id":"https://openalex.org/I4210150008","display_name":"Robert Gordon's College","ror":"https://ror.org/04fa9he73","country_code":"GB","type":"education","lineage":["https://openalex.org/I4210150008"]},{"id":"https://openalex.org/I522815984","display_name":"Robert Gordon University","ror":"https://ror.org/04f0qj703","country_code":"GB","type":"education","lineage":["https://openalex.org/I522815984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Nadeeka Pathirana","raw_affiliation_strings":["School of Computing, Engineering and Technology, Robert Gordon University"],"raw_orcid":"https://orcid.org/0009-0000-0750-9991","affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and Technology, Robert Gordon University","institution_ids":["https://openalex.org/I522815984","https://openalex.org/I4210150008"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053401254","display_name":"Ruby Roberts","orcid":"https://orcid.org/0000-0001-5420-7945"},"institutions":[{"id":"https://openalex.org/I522815984","display_name":"Robert Gordon University","ror":"https://ror.org/04f0qj703","country_code":"GB","type":"education","lineage":["https://openalex.org/I522815984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ruby Roberts","raw_affiliation_strings":["Aberdeen Business School, Robert Gordon University"],"raw_orcid":"https://orcid.org/0000-0001-5420-7945","affiliations":[{"raw_affiliation_string":"Aberdeen Business School, Robert Gordon University","institution_ids":["https://openalex.org/I522815984"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005926383","display_name":"Harsha Kalutarage","orcid":"https://orcid.org/0000-0001-6430-9558"},"institutions":[{"id":"https://openalex.org/I4210150008","display_name":"Robert Gordon's College","ror":"https://ror.org/04fa9he73","country_code":"GB","type":"education","lineage":["https://openalex.org/I4210150008"]},{"id":"https://openalex.org/I522815984","display_name":"Robert Gordon University","ror":"https://ror.org/04f0qj703","country_code":"GB","type":"education","lineage":["https://openalex.org/I522815984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Harsha Kalutarage","raw_affiliation_strings":["School of Computing, Engineering and Technology, Robert Gordon University"],"raw_orcid":"https://orcid.org/0000-0001-6430-9558","affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and Technology, Robert Gordon University","institution_ids":["https://openalex.org/I522815984","https://openalex.org/I4210150008"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058062052","display_name":"Christopher D. McDermott","orcid":"https://orcid.org/0000-0001-8718-0988"},"institutions":[{"id":"https://openalex.org/I4210150008","display_name":"Robert Gordon's College","ror":"https://ror.org/04fa9he73","country_code":"GB","type":"education","lineage":["https://openalex.org/I4210150008"]},{"id":"https://openalex.org/I522815984","display_name":"Robert Gordon University","ror":"https://ror.org/04f0qj703","country_code":"GB","type":"education","lineage":["https://openalex.org/I522815984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Christopher D. McDermott","raw_affiliation_strings":["School of Computing, Engineering and Technology, Robert Gordon University"],"raw_orcid":"https://orcid.org/0000-0001-8718-0988","affiliations":[{"raw_affiliation_string":"School of Computing, Engineering and Technology, Robert Gordon University","institution_ids":["https://openalex.org/I522815984","https://openalex.org/I4210150008"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.13974238,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"58","issue":"10","first_page":"1","last_page":"37"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8568999767303467,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8568999767303467,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10809","display_name":"Occupational Health and Safety Research","score":0.014600000344216824,"subfield":{"id":"https://openalex.org/subfields/3614","display_name":"Radiological and Ultrasound Technology"},"field":{"id":"https://openalex.org/fields/36","display_name":"Health Professions"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},{"id":"https://openalex.org/T13582","display_name":"Stalking, Cyberstalking, and Harassment","score":0.010099999606609344,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.9424999952316284},{"id":"https://openalex.org/keywords/insider","display_name":"Insider","score":0.8087000250816345},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5242000222206116},{"id":"https://openalex.org/keywords/taxonomy","display_name":"Taxonomy (biology)","score":0.4697999954223633},{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.3483000099658966}],"concepts":[{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.9424999952316284},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.8087000250816345},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6687999963760376},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5242000222206116},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.4697999954223633},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.46540001034736633},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.4230000078678131},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3982999920845032},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.3483000099658966},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.30640000104904175},{"id":"https://openalex.org/C2992130261","wikidata":"https://www.wikidata.org/wiki/Q1331083","display_name":"Human research","level":2,"score":0.27630001306533813},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.2680000066757202},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.26440000534057617},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.26080000400543213},{"id":"https://openalex.org/C107645774","wikidata":"https://www.wikidata.org/wiki/Q5467169","display_name":"Human resources","level":2,"score":0.2529999911785126}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3798089","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3798089","pdf_url":null,"source":{"id":"https://openalex.org/S157921468","display_name":"ACM Computing Surveys","issn_l":"0360-0300","issn":["0360-0300","1557-7341"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Computing Surveys","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.44263389706611633,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":61,"referenced_works":["https://openalex.org/W1575416741","https://openalex.org/W1922025691","https://openalex.org/W1964676527","https://openalex.org/W1995120430","https://openalex.org/W2029014126","https://openalex.org/W2059256333","https://openalex.org/W2778865020","https://openalex.org/W2795060553","https://openalex.org/W2902026952","https://openalex.org/W2920929998","https://openalex.org/W2947189214","https://openalex.org/W2954118786","https://openalex.org/W2965681684","https://openalex.org/W2966644954","https://openalex.org/W3019933808","https://openalex.org/W3030742098","https://openalex.org/W3037095750","https://openalex.org/W3041204984","https://openalex.org/W3045880080","https://openalex.org/W3056725291","https://openalex.org/W3083528220","https://openalex.org/W3091467544","https://openalex.org/W3102089875","https://openalex.org/W3109130759","https://openalex.org/W3123893780","https://openalex.org/W3126074005","https://openalex.org/W3130625521","https://openalex.org/W3166620705","https://openalex.org/W3169956502","https://openalex.org/W3176981068","https://openalex.org/W3198361544","https://openalex.org/W3211065488","https://openalex.org/W4224217353","https://openalex.org/W4236514901","https://openalex.org/W4247092506","https://openalex.org/W4285389965","https://openalex.org/W4287889980","https://openalex.org/W4288083473","https://openalex.org/W4310346488","https://openalex.org/W4313372151","https://openalex.org/W4317569503","https://openalex.org/W4328053447","https://openalex.org/W4376108124","https://openalex.org/W4381486732","https://openalex.org/W4383103607","https://openalex.org/W4386484209","https://openalex.org/W4387584130","https://openalex.org/W4387735664","https://openalex.org/W4389386867","https://openalex.org/W4389937376","https://openalex.org/W4390871511","https://openalex.org/W4392151675","https://openalex.org/W4392405523","https://openalex.org/W4392634024","https://openalex.org/W4395468263","https://openalex.org/W4398151663","https://openalex.org/W4398249818","https://openalex.org/W4402563056","https://openalex.org/W4408228258","https://openalex.org/W4413000016","https://openalex.org/W4415057332"],"related_works":[],"abstract_inverted_index":{"Insider":[0],"threats,":[1,77],"originating":[2],"from":[3],"current":[4,158],"or":[5,37,93],"former":[6],"employees,":[7],"contractors":[8],"and":[9,40,48,61,78,114,152,160,169],"trusted":[10],"business":[11],"partners":[12],"who":[13],"are":[14,41],"with":[15],"authorised":[16],"access":[17],"to":[18,22,64,75,91,138,144],"organisational":[19],"resources":[20],"continue":[21],"pose":[23],"a":[24,106,127],"critical":[25],"security":[26],"challenge":[27],"across":[28],"multiple":[29],"sectors.":[30],"These":[31],"threats":[32,96,188],"may":[33],"be":[34],"intentional":[35],"(malicious)":[36],"unintentional":[38,191],"(accidental)":[39],"shaped":[42],"by":[43],"the":[44,98,145,173,180],"interaction":[45],"between":[46,59],"technical":[47,82,119],"human":[49,72,101,109,136,154,184],"factors.":[50,102],"This":[51],"systematic":[52],"literature":[53],"review":[54,104],"analyses":[55],"121":[56],"studies":[57],"published":[58],"2014":[60],"October":[62],"2025":[63],"address":[65],"two":[66],"key":[67,167],"research":[68,133,170],"questions:":[69],"(1)":[70],"which":[71],"factors":[73,110,137,185],"contribute":[74],"insider":[76,95,112,139,187,192],"(2)":[79],"whether":[80],"existing":[81],"methods,":[83],"particularly":[84],"machine":[85,131],"learning":[86,132],"approaches,":[87,120],"have":[88],"been":[89],"applied":[90],"predict":[92],"detect":[94],"on":[97],"basis":[99],"of":[100,108,118,147,183],"The":[103,124],"introduces":[105],"taxonomy":[107],"influencing":[111],"behaviour":[113],"provides":[115],"an":[116],"examination":[117],"including":[121],"detection":[122],"methods.":[123],"findings":[125],"highlight":[126],"substantial":[128],"gap":[129],"in":[130,186,190],"directly":[134],"linking":[135],"threat":[140],"detection,":[141],"largely":[142],"due":[143],"absence":[146],"datasets":[148],"that":[149,178],"integrate":[150],"behavioural":[151],"contextual":[153],"attributes.":[155],"By":[156],"synthesising":[157],"knowledge":[159],"identifying":[161],"these":[162],"limitations,":[163],"this":[164],"study":[165],"outlines":[166],"challenges":[168],"opportunities,":[171],"underscoring":[172],"need":[174],"for":[175],"predictive":[176],"models":[177],"capture":[179],"complex":[181],"role":[182],"especially":[189],"threats.":[193]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-02-20T00:00:00"}