The answer is a change in job title or a lateral move to another team. A promotion, reassignment, or transfer is an administrative event recorded in HR systems, and on its own it tells you nothing about threat potential. Early indicators are behavioral and access-based: unusual after-hours access to systems outside a person's role, attempts to bypass security controls, unexplained handling of classified or sensitive material, sudden financial distress paired with access to valuable data, disgruntlement that escalates into expressed intent, and unreported foreign contacts where policy requires reporting. The job-title option is the distractor precisely because it describes a normal career event that thousands of cleared employees experience every year without incident.
The keyword phrasing mirrors a multiple-choice item used in U.S. government insider-threat awareness training, including the Defense Counterintelligence and Security Agency's. Those courses teach a list of observable behaviors and deliberately include benign administrative changes among the answer choices to test whether the learner can separate a career event from a risk signal. The distinction matters operationally. Treating transfers as indicators floods a threat-management team with false positives, while missing genuine behavioral patterns is how the National Insider Threat Task Force's reporting guidance says most preventable incidents slip through. This article walks through the real indicators, why the administrative one fails the test, and how programs actually triage what employees report.
What the Question Is Really Testing in Insider-Threat Training
The item tests whether you can distinguish an observable behavior from a background fact. Training material built on the National Insider Threat Task Force's framework treats indicators as actions a person takes, patterns in how they use access, or statements they make. A job change is none of those. It's an event that happens to someone, often decided by managers the person doesn't control.
DCSA's insider-threat awareness course, delivered to cleared personnel across the defense industrial base, frames the learner's job as noticing and reporting, not diagnosing. That framing is deliberate. Employees see behavior, not motives. A report that says "my coworker transferred to another program" gives a threat team nothing to assess.
The distractors in these items are chosen to look vaguely suspicious. A transfer can precede a departure, and departures do correlate with some data-theft cases. But correlation with a rare outcome isn't an early indicator. The single best-known insider case in recent U.S. history, that of Edward Snowden, involved a contractor who remained in his role while exfiltrating material; no transfer preceded it.
Read the question as asking which option fails the definition, not which option is safest to flag. Anything an employee could report in good faith can be reviewed. The test is whether the item names a behavior the program can act on.
The Six Indicators That Do Belong on the List
Real indicator lists converge on a small set of categories, and DCSA's awareness material and the National Insider Threat Task Force's guidance describe them consistently. First, unauthorized access attempts: trying to reach systems, folders, or facilities outside the person's need to know, especially repeatedly or with workarounds. Second, efforts to circumvent security controls, such as disabling logging, using personal devices for sensitive work, or asking colleagues to share credentials.
Third, unusual after-hours or off-site activity, particularly bulk queries, downloads, or printing that exceed the person's normal pattern. Fourth, unexplained affluence or financial distress where the person handles valuable data or material, since financial pressure is the most frequently cited motive in espionage prosecutions. Fifth, disgruntlement that moves from general complaining to specific statements about retaliation, grievance against the organization, or sympathy for a cause hostile to the employer.
Sixth, unreported contacts with foreign intelligence services or foreign nationals where reporting is required, plus unexplained foreign travel. The FBI's counterintelligence reporting and DCSA's cleared-employee reporting requirements both cover this category. Each indicator describes something the person did, said, or visibly failed to do, which is what makes it actionable.
Why a Job Change Fails the Indicator Test
A job change is routine across the cleared workforce, and its base rate makes it useless as a signal. The Office of the Director of National Intelligence's annual security clearance determinations run into the hundreds of thousands of favorable actions, and internal transfers inside agencies and contractors happen at similar scale. A metric that flags millions of career moves to catch a handful of insider cases fails on precision alone.
The occasional real signal in a transfer is timing. A person who resigns abruptly and then accesses sensitive files in the final two weeks is a genuine concern, and departure-period monitoring exists for that reason. But the indicator there is the access behavior during notice, not the move itself. Training items that list "job change" among indicators confuse the administrative event with the behavioral pattern that sometimes accompanies it.
Disgruntlement over a denied promotion is also distinct from the promotion itself. A person passed over who makes threatening statements about the organization is a reportable concern. A person who accepts a lateral move is not. If you're building a quiz or a training slide, keep the disposition separate from the decision.
Applying the Test to a Research Scientist Who Resigns
Consider a cleared researcher who gives two weeks' notice and, in that window, downloads 4,000 pages from a program she never worked on. The resignation is administrative. The download volume against the wrong program is the indicator. DCSA reporting guidance for cleared personnel treats unusual access near departure as exactly the pattern worth flagging, which is why exit briefings include reminders about continued obligations.
Now flip the scenario. A researcher transfers to a different lab inside the same company, retains the same clearance, and accesses only her new program's files after the effective date. Nothing here meets an indicator definition. Her manager might mention the move in a routine report, and the threat team would close it.
The two cases produce identical administrative metadata for the job change and opposite threat assessments. Only the access behavior differentiates them. That's the whole point of the question.
Building an Indicator List That Survives Audit
Programs that mature past the multiple-choice stage write their indicator lists as observable behaviors with a named system of record. An access anomaly comes from badge logs and data-loss-prevention alerts. Financial indicators come from voluntary self-reporting or adjudication records, not from credit checks an employer runs without consent. Foreign-contact indicators come from the employee's own required reporting.
The Defense Counterintelligence and Security Agency's insider-threat hub publishes a behavioral indicator reference that civilian agencies adapt. The National Insider Threat Task Force's minimum standards for insider-threat programs, established under Executive Order 13587, require a designated program office and a reporting mechanism with a trained triage function. Both documents push toward specificity because a triage analyst cannot investigate "seems disgruntled."
For practitioners, the test for any proposed indicator is simple. Can an employee observe it, can the program verify it, and does the resulting report tell an investigator where to look? A transfer fails all three.
When Reporting Fire Is a Normal Part of the Job
Many roles generate financial stress as a feature, not a bug. Someone who just bought a house, had a child, or is paying tuition is carrying debt that would look alarming on a spreadsheet. That's why financial indicators only function alongside access to something valuable. A debt-laden employee in a job with no access to sensitive information poses no insider-threat concern, and treating them as one is both unfair and a waste of investigator hours.
The same logic applies to foreign nationality or travel. DCSA and agency security offices require reporting of certain foreign contacts, and the indicator is the failure to report, not the contact itself. A cleared employee with relatives abroad who files the required report is compliant. One who conceals a contact is not.
Programs that skip this distinction end up with what security officers describe as "black hole" reporting, where employees stop submitting anything because everything seems to trigger scrutiny. Voluntary reporting is the foundation of the whole system, so precision protects participation.
Predicting False Positives With Base Rates
Pulling the arithmetic makes the case for why sloppy indicators can't survive. Suppose a workforce of 100,000 cleared employees has a true insider-threat incident rate of 1 in 10,000, meaning ten genuine cases in a period. Now suppose a broad indicator like "job change" has only a 5 percent annual prevalence in that population, meaning 5,000 people. If the indicator also captured every genuine insider at a very optimistic 50 percent rate, it would produce five true flags against roughly 4,995 false ones. The false positive rate is over 99 percent.
The math is deliberately simplified, but it mirrors how security officers reason about investigative load. A team of five analysts can't meaningfully triage 5,000 cases. They can triage dozens. Precision isn't a luxury, it's what determines whether a program functions.
Try the same calculation with a tighter indicator, say "bulk download outside a person's program at volume above a defined threshold." If that captures 20 people a year with a 40 percent hit rate, the analyst has eight real cases and twelve investigations that clear. That workload runs.
Triage: Who Checks an Indicator Before It Becomes a Case?
Triage is the part most training materials skip, and it's where the administrative-versus-behavioral distinction gets applied in practice. In a compliant program under the National Insider Threat Task Force's minimum standards, reports go to a designated program office that reviews them against defined criteria, then routes the ones with substance to investigators or to the counterintelligence element. Because the program office operates inside a multi-disciplinary hub, it can pull access logs and consult HR and legal simultaneously.
Analysts look for patterns, not single events. One after-hours login is noise; a weekly pattern of bulk file activity at 2 a.m. in a role that never does that is a question. One angry email is noise; a series of escalations in which the person articulates a plan is not. A new car is noise; a new car on a salary that makes it impossible is a question.
The triage result isn't a determination of guilt. DCSA materials emphasize that reporting is about risk management, not accusation, and that cleared employees face no retribution for making a good-faith report. A program that doesn't tell employees this in writing will lose its best early-warning sensor: the colleague who notices.
Adapting the Question for Security Awareness Training
If you write training material, build the multiple-choice item so the correct answer is an administrative fact, and include at least two plausible behavioral distractors. Our lead answer—a job change—works as the answer only if the distractors are real indicators, not invented ones. Use "bulk downloads from a system outside the person's duties" and "expressed sympathy for an adversarial state" as distractors, and the learner has to actually distinguish.
Add a scenario follow-up. Present a transfer and a set of concurrent behaviors, then ask which specific behavior needs reporting. This mirrors agency practice, where training modules pair a knowledge check with a case vignette and a reporting-point address.
Keep the item stable across refreshers. DCSA refreshes awareness content periodically, so check the current courseware before reusing any wording in a licensed product, and cite the agency version you built from rather than copying text.
The final paragraph here is the one to carry forward: the correct option is the administrative change, and the six behavioral categories are the ones that earn a report. Get that distinction into your slides and your program is ahead of most.
FAQ
Does the correct answer depend on which version of the question I'm seeing?
Yes, because the options change between course editions and agencies. The phrasing "which one of the following is not an early indicator" appears in DCSA and agency-adapted quizzes, and the option set can substitute one benign item for another—typically a job change, a routine transfer, or a compensation adjustment. Read the four options and pick the one that is a background fact rather than an observable behavior; don't memorize option letters.
Is a resignation itself ever a reportable indicator?
No—notice is administrative. What warrants reporting is the behavior around it: sudden bulk access to files outside the person's program, inquiries about storage devices, or attempts to copy material in the final days. Departure-period monitoring exists to catch that behavior, and program offices are trained to distinguish notice from exfiltration.
Can someone be an insider threat without showing any of the six indicators?
Yes, and history shows it. Edward Snowden remained in his job, accessed material within his job's apparent scope, and exfiltrated it using tools and credentials that didn't register as out-of-pattern until it was too late. That's why programs combine behavioral reporting with technical controls like data-loss prevention and access monitoring—behavioral lists are necessary but not sufficient.
Where do cleared employees report an insider-threat concern?
Through their agency or company's designated insider-threat reporting channel, or to the security office, counterintelligence element, or inspector general where the organization specifies. Reporting channels are documented in the program's insider-threat plan, which Executive Order 13587 requires. Teams should confirm the current hotline or portal on their employer's intranet rather than relying on an old training handout.
How do I compare a transfer indicator against a behavioral indicator for my program?
Use a side-by-side on three dimensions: observability (can an employee see it?), verifiability (can the program confirm it in a system of record?), and actionability (does it tell an investigator where to look?). A transfer scores low on all three; out-of-pattern bulk downloading scores high on all three. Build your program's indicator list around the high-scoring columns.
How does the False positive precedence of this quiz item matter to compliance?
Not much directly, but precision does. Insider-threat reporting obligations sit alongside privacy and employee-relations rules, and an indicator list that generates thousands of near-certain false positives increases privacy exposure and weakens the voluntary reporting that makes programs work. Legal and privacy officers should review any new indicator before it goes into training or triage criteria. This article is general educational information, not legal advice; consult your organization's counsel and privacy officers for rules that apply to your jurisdiction and contracts.