Related Concept Videos
Understanding Deception
Language and Cognition
Leaky Scanning
Stereotype Threat and Self-fulfilling Prophecies
Impression Management Techniques III: Aligning Actions
Impression Management Techniques IV: Altercasting
You might also read
Related Articles
Articles linked to this work by shared authors, journal, and citation graph.
Related Experiment Video
Updated: May 10, 2026

Memorization-Based Training and Testing Paradigm for Robust Vocal Identity Recognition in Expressive Speech Using Event-Related Potentials Analysis
Published on: August 9, 2024
Detecting insider threats through language change.
Paul J Taylor1, Coral J Dando, Thomas C Ormerod
1Department of Psychology, Lancaster University, Lancaster, UK. p.j.taylor@lancaster.ac.uk
Analyzing workplace emails revealed that employees conducting insider attacks exhibit distinct linguistic changes. These changes include increased self-focus, negative emotions, and altered communication patterns, offering a way to identify such behavior.
Area of Science:
- Psychology
- Computer Security
- Linguistics
Background:
- Insider attacks pose significant threats to organizations, often stemming from cognitive and social challenges faced by offenders.
- Understanding the behavioral manifestations of insider threats is crucial for developing effective detection methods.
Purpose of the Study:
- To investigate how engaging in an insider attack simulation affects an individual's language use in workplace emails.
- To determine if linguistic analysis can serve as an indirect indicator of insider threat behavior.
Main Methods:
- A 6-hour workplace simulation involving 54 participants in an organized crime investigation scenario.
- Covertly incentivizing 25% of participants to act as insiders by providing information to a provocateur.
- Analyzing email communication for linguistic markers of self-focus, negative affect, cognitive processing, and interpersonal mimicry.
Main Results:
- Insiders exhibited increased self-focus, greater negative affect, and heightened cognitive processing in their email language compared to non-insiders.
- A significant decline in linguistic mimicry of team members was observed among insiders over time.
- Language analysis revealed distinct patterns differentiating insiders from their colleagues.
Conclusions:
- Linguistic analysis of workplace communications can serve as a valuable tool for indirectly identifying employees engaged in insider attacks.
- The study highlights the subtle yet detectable cognitive and social shifts associated with insider threat behavior.
- These findings have implications for developing proactive security measures and employee monitoring systems.