Why does insider threat detection need an emotional signal layer?

Digital behaviour monitoring systems — UEBA, SIEM, DLP — only detect anomalies after a digital act has occurred. But insider threat research consistently shows that emotional and behavioural changes precede digital acts by days, weeks, or months. Financial stress, ideological grievance, coercion, or personal crisis manifest in facial and behavioural signals before they manifest as unusual file access or credential misuse. EchoDepth provides continuous emotional baseline monitoring that surfaces these pre-digital signals.

What is the average cost of an insider threat incident?

The Ponemon Institute's 2023 Cost of Insider Threats report estimated the average annual cost per insider threat incident at $16.2 million globally. For UK organisations, the equivalent figure accounting for regulatory environment and market context translates to approximately £3.2 million per incident on average. These costs include investigation, remediation, regulatory fines, legal costs, and reputational damage.

How does EchoDepth monitor for insider threat without being invasive?

EchoDepth monitors facial Action Units using existing camera infrastructure — CCTV, desk cameras, or room cameras already in place. It establishes an emotional baseline per individual over time, then scores deviations from that baseline. The system does not flag specific emotions as suspicious; it identifies statistically significant departures from an individual's own established pattern. All data is pseudonymised, processed within UK borders, and subject to role-based access control and full audit logging under UK GDPR.

← Insights Operator Readiness · Human Factors May 2026

Operator Fatigue Detection:
AI Monitoring for High-Stakes Defence Environments

Fatigue is implicated in 23% of military near-misses. It degrades decision quality, increases risk tolerance, and impairs threat recognition — in ways that are not reliably self-reported. AI facial AU analysis monitors cognitive readiness continuously, without wearables or workflow interruption.

The fatigue problem in defence operations

Military and high-stakes security operations regularly require sustained attention under conditions that systematically induce fatigue: extended shifts, overnight surveillance, continuous monitoring roles, and the cumulative cognitive load of command and control environments. NATO review of military near-misses attributes approximately 23% of incidents to operator fatigue as a contributing factor — not as the sole cause, but as the degradation that pushed a manageable situation past the threshold of human error.

The challenge is detection. Fatigue impairs self-assessment — fatigued individuals consistently overestimate their own readiness, and the impairment to metacognition is an effect of the fatigue itself. Self-reporting systems, mandatory rest schedules, and supervisory observation all have demonstrated limitations in capturing actual cognitive state at the moment of operational exposure.

What facial AUs reveal about cognitive state

Fatigue produces predictable changes in facial muscle activation that occur before subjective awareness and before performance degradation becomes operationally significant. The primary markers: blink rate elevation (AU45) is one of the earliest and most reliable indicators of sleep pressure, preceding performance impairment by 30–45 minutes in laboratory conditions. Eye closure patterns (AU43) indicate microsleep — involuntary lapses of 1–3 seconds that operators are unaware of and do not report. Diminished positive expression amplitude (reduced AU6 and AU12 range) reflects the emotional blunting that accompanies cognitive overload.

EchoDepth analyses all 44 FACS-compliant AUs per frame continuously, mapping the composite to Arousal dimension scores that track cognitive readiness state. The system establishes an individual baseline during normal-readiness conditions and detects sustained deviation — not single-frame anomalies — as the signal for intervention.

Deployment in operational environments

EchoDepth operates on standard IP cameras and webcams already present in most defence operational environments. No wearables, no contact sensors, no hardware modifications to operator workstations. The system runs on-premise with no external data dependency — appropriate for classified and SCIF environments where network egress is restricted.

Two deployment configurations are available. Operator-aware mode surfaces a readiness score to the individual, prompting voluntary rest before threshold breach — appropriate for environments where operator buy-in is a priority and self-regulation is a realistic expectation. Background mode surfaces signals to supervisors without operator notification — appropriate for environments where baseline integrity requires unobtrusiveness.

Integration with existing operational protocols

EchoDepth fatigue detection is designed to integrate with existing duty scheduling, handover protocols, and performance management systems. Output is a continuous readiness score and event-triggered alert when sustained fatigue thresholds are crossed — not a replacement for human supervisory judgement, but a persistent sensor layer that operates between supervisory observation intervals.

Related capability

Operator readiness monitoring for defence and security operations

Continuous cognitive state monitoring. FACS fatigue detection. No wearables. SCIF-compatible. Configurable alert thresholds.

Operator Readiness Solution Request a Technical Briefing

Operator Fatigue Detection:AI Monitoring for High-Stakes Defence Environments