An essential component for insider threat anomaly detection will be represented by Neural Networks and Associative Memories (NAM), which are able to recognize and predict patterns of activity and identify normalcy benchmarks for data/metadata values and associations between all the key people, processes, entities and data attributes. Any event identified as not fitting the benchmark needs to be surfaced and reported as a “red-flag”: an early-warning indicator of malicious activity.