Agencies should adopt a layered security approach that combines access, identity and security event management to detect and disrupt insider threats before damage is done.