Case Study

Strengthening Insider Risk and Data Defense at USPTO

Problem

The United States Patent and Trademark Office (USPTO) needed to enhance its Insider Risk Program to mitigate threats posed by trusted insiders. A Gap Analysis revealed vulnerabilities requiring remediation across endpoints, networks, data, identity management, and automation platforms. USPTO also sought to integrate AI-driven security capabilities and automate insider threat detection while ensuring interoperability with existing security tools.

Solution

Insignia established a PMO for the Insider Risk Program, providing governance support and strategic planning. We conducted a comprehensive security assessment, aligning USPTO’s security posture with Zero Trust principles and CISA’s Zero Trust Maturity Model (ZTMM v2). Our team implemented a phased remediation plan, working closely with system owners to enhance security controls and streamline workflows.

We developed AI-driven analytics for insider threat detection, including data exfiltration monitoring, unauthorized software detection, and user behavior analytics (UBA). To improve efficiency, Insignia automated 20+ security workflows, enabling real-time alerts, compliance enforcement, and seamless monitoring of employee activities. Our team also led the integration of Microsoft security tools within USPTO’s Security Operations Center (SOC), consolidating security data into a unified Sentinel dashboard for enhanced threat visibility.

Results

Since 2022, the Insider Risk Team (IRT) has identified and addressed 51 security gaps, with all but 9 fully remediated as of May 2024. Automated workflows have streamlined insider threat monitoring, reduced manual workload, and enhanced SOC efficiency. Integration with Microsoft and third-party security tools, including ServiceNow and OKTA, improved real-time security operations and data exchange accuracy.

Through AI-driven security enhancements, automation, and Zero Trust alignment, Insignia has strengthened USPTO’s ability to detect, mitigate, and prevent insider threats, ensuring long-term security and operational resilience.