The way a SOC analyst is trained to respond to security threats is very different from how an analyst dealing with an insider threat incident should respond. The difference is even more apparent when you consider a false positive with an insider event could cost a peer his or her job, reputation and more. In this talk, I will discuss the rise of insider threats, why you see more cases of them, and how to perform investigations in an empathetic way.