Insider Watch Index (IWI)
The leading indicator of a whistleblower, weeks before a story breaks. The most-watched internal signal.
Formula
Thresholds & Bands
| Band | Range | State |
|---|---|---|
| Quiet | < 10 | ok |
| Active | 10-25 | warn |
| Leak risk | > 25 | crit |
Why This Metric Matters
The Insider Watch Index is the Directorate's earliest-warning system against information breach. Whistleblower events are existential risks — a single successful disclosure can unravel years of narrative construction and trigger regulatory cascade failures. IWI provides Counter-Intelligence with the lead time necessary to intervene through reassignment, compartment restriction, or kompromat deployment before a potential leaker makes external contact. The continuous nature of this metric reflects the Directorate's assessment that insider threats do not observe business hours.
Threshold Justification
The quiet-state ceiling of 10 was calibrated against the 18-month behavioral baseline established during PANOPTICON's initial deployment, representing normal variance in access patterns and external communications. The leak-risk threshold of 25 was set after retroactive analysis of three confirmed exfiltration attempts, all of which produced index values between 23 and 31 in the 72 hours preceding contact with external parties.
Historical Context
IWI has triggered the leak-risk band four times since implementation. Two of those events resulted in successful preemptive interdiction; the remaining two were false positives caused by authorized but unlogged cross-compartment research. The index was recalibrated in Q1 2025 to incorporate Halo cognitive-stress telemetry, which reduced false-positive rates by approximately 40%.
Collection Method
The index is computed continuously by PANACEA's Counter-Intelligence module from three primary signal classes: anomalous data-access patterns logged by the Synaptic Data Fabric (volume, timing, compartment mismatch), staff-to-press communication intercepts from VITALNET's external-contact monitoring layer, and exfiltration indicators including removable media usage, encrypted personal-device traffic, and print-queue anomalies. Halo-equipped personnel contribute an additional cognitive-affect signal weighted by role sensitivity.
Known Failure Modes
The index underreports risk for personnel in senior compartments who possess legitimate broad-access credentials, as their baseline access patterns are inherently noisy. Air-gapped exfiltration methods — physical document removal, memorized data — produce no digital signal and are invisible to the automated pipeline. Seasonal spikes during annual review cycles, when staff routinely access archived materials, have historically produced 1-2 false warn-state elevations per year.