---
title: [Webinar] What Insider Threats Actually Look Like - A Lesson from Rippling's Lawsuit
description: Join us on Thursday, April 10 at 2pm ET/11am PT for a webinar where Ian Ahl, SVP of P0 Labs will comb through the Rippling lawsuit. He'll break down how an alleged malicious insider searched for and exfiltrated data like sales pipeline and other sensitive information, and how security teams can better detect anomalous activity like this in their own environment.
image: https://hero.permiso.io/hubfs/Rippling%20Webinar%20(1200x628).png
---

** [![Permiso](https://hero.permiso.io/hubfs/Permiso%202023.03.30/images/logo-permiso-dark.svg) ](https://permiso.io/?hsLang=en) **

Menu

** [![Permiso](https://hero.permiso.io/hubfs/Permiso%202023.03.30/images/logo-permiso-light.svg) ](https://permiso.io/?hsLang=en) **

- [ Product ](https://permiso.io/product/?hsLang=en)
- [ About ](https://permiso.io/about/?hsLang=en)
- [ P0 Labs ](https://permiso.io/p0-labs/?hsLang=en)
- [ Resources ](https://permiso.io/product/?hsLang=en)
- [ Contact ](https://permiso.io/contact/?hsLang=en)

[ Sign in ](https://arbiter.permiso.io/)

- [** ](https://twitter.com/permisosecurity)
- [** ](https://www.linkedin.com/company/permiso-security/)

© Permiso Security 2022  |  [Privacy Policy](https://permiso.io/legal/privacy?hsLang=en)  |  [Terms](https://permiso.io/legal/terms?hsLang=en)

# What Insider Threats Actually Look Like

#### A Lesson from Rippling's Lawsuit

![Rippling Webinar - with icon CTA (1200x700)](https://hero.permiso.io/hs-fs/hubfs/Rippling%20Webinar%20-%20with%20icon%20CTA%20(1200x700).png?width=800&height=468&name=Rippling%20Webinar%20-%20with%20icon%20CTA%20(1200x700).png)

Ian Ahl, SVP of P0 Labs, combs through the Rippling lawsuit. He breaks down how an alleged malicious insider searched for and exfiltrated data like sales pipeline and other sensitive information, and how security teams can better detect anomalous activity like this in their own environment. In this 45 minute webinar, you will learn:

- How search logs can often show clear intent of threat actors
- Why insider threats often strongly resemble attacks orchestrated by advanced threat actor groups
- How security teams can better monitor for anomalous behavior in their own environments to detect insider threats early

 

#### Watch This Webinar

# Our Speaker

![Ian](https://hero.permiso.io/hubfs/Permiso_Security_June2023/images/Ian.png)

##### Ian Ahl

Ian Ahl is the current SVP of P0 Labs, the threat research arm of the Identity Security startup Permiso.

 

Ian Ahl is a cybersecurity expert that has established himself as an industry export in the field of digital forensics and incident response. With a career spanning over two decades, Ahl has played a pivotal role in safeguarding organizations against sophisticated cyber threats. His expertise extends across strategic threat intelligence, malware analysis, and cybersecurity consulting, where he has led numerous high-profile investigations into cyber breaches affecting multinational corporations and government entities.

 

As the former head of Mandiant's Advanced Practice team, Ian Ahl has contributed significantly to advancing cybersecurity practices globally. His insights and methodologies have been instrumental in developing cutting-edge solutions to combat cyber espionage, ransomware attacks, and other complex cyber incidents. Ahl's dedication to enhancing cybersecurity resilience has earned him recognition among peers and clients alike, solidifying his reputation as a trusted advisor and thought leader in the cybersecurity

 

[ Linkedin Profile ](https://www.linkedin.com/in/ian-ahl-50876612/)

** [![Permiso](https://hero.permiso.io/hubfs/Permiso%202023.03.30/images/logo-permiso-light.svg) ](https://permiso.io/?hsLang=en) **

- [ Product ](https://permiso.io/product/?hsLang=en)
- [ About ](https://permiso.io/about/?hsLang=en)
- [ Join Our Team ](https://permiso.io/product/?hsLang=en)

- [ P0 Labs ](https://permiso.io/p0-labs/?hsLang=en)
- [ Cloud Incident Report ](https://permiso.io/p0-labs/services/cloud-incident-response/?hsLang=en)
- [ Resources ](https://permiso.io/p0-labs/?hsLang=en)

- [ Request a Demo ](https://permiso.io/?hsLang=en#get-in-touch)
- [ Contact us ](https://permiso.io/contact/?hsLang=en)
- [ Sign In ](https://arbiter.permiso.io/account/login)

- [** ](https://twitter.com/permisosecurity)
- [** ](https://www.linkedin.com/company/permiso-security/)

© Permiso Security 2023  |  [Privacy Policy](https://permiso.io/legal/privacy?hsLang=en)  |  [Terms](https://permiso.io/legal/terms?hsLang=en)