Insider attacks can be some of the most damaging. To date, most solutions rely on centralized analysis of data. A new approach makes use of real time analytics at the edge to detect and even prevent attacks. A review of three recent insider threat case studies will show how placing intelligence at the point of compromise provides a faster, more efficient means to protect against insider threats.