Continuous and anonymous risk evaluation

A computer-implemented method for insider threat monitoring comprising:

• receiving, by server computer of a monitoring computing system from a requesting entity computer over a network, a request for monitoring of a plurality of target entities, the request comprising, for each target entity, of the plurality of target entities, a first identifier associated with the target entity and information about the target entity, the requesting entity computer being part of a requesting entity computing system separate from the monitoring computing system;
• for each target entity, of the plurality of target entities:
• generating, by the server computer, a second identifier associated with the target entity based on the information about the target entity, the second identifier being prevented from being provided to the requesting entity computer, wherein generating the second identifier associated with the target entity based on the information about the target entity comprises comparing the target entity information received from the requesting entity computer to target entity information stored by the server computer to assign a persistent key to the target entity for monitoring;
• monitoring, by the server computer, a periodically updated data set and determining a risk metric for the target entity based on monitoring the periodically updated data set;
• comparing, by the server computer, the risk metric of the target entity to a threshold value;
• based on the comparison, generating a third identifier associated with the risk metric of the target entity;
• and
• storing, in a secure database of the monitoring computing system, a mapping of the second identifier to the first identifier and the third identifier to the first identifier and the second identifier;
• identifying a plurality of third identifiers corresponding to a subset of the plurality of target entities with indicators of an increased insider threat risk;
• providing, by the server computer, the plurality of third identifiers to the requesting entity computer over the network;
• responsive to providing the plurality of third identifiers, receiving, by the server computer from the requesting entity computer over the network, a request for a first identifier associated with a particular third identifier, of the plurality of third identifiers;
• using the particular third identifier and the stored mapping to identify, by the server computer, the requested first identifier;
• providing, by the server computer to the requesting entity computer over the network, the requested first identifier and the particular third identifier;
• and
• responsive to providing the first identifier, updating target entity information stored by the server computer to include a soft credit hit, wherein the monitoring of the periodically updated data set and the providing of the third identifiers to the requesting entity computer do not result in adding the soft credit hit to the target entity information stored by the server computer.

A non-transitory computer-readable medium of a monitoring computing system having instructions stored thereon, the instructions, when executed by a processing device, cause performance of a method comprising:

• receiving, from a requesting entity computer over a network, a request for monitoring of a plurality of target entities, the request comprising, for each target entity, of the plurality of target entities, a first identifier associated with the target entity and information about the target entity, the requesting entity computer being part of a requesting entity computing system separate from the monitoring computing system;
• for each target entity, of the plurality of target entities:
• generating a second identifier associated with the target entity based on the information about the target entity, the second identifier being prevented from being provided to the requesting entity computer, wherein generating the second identifier associated with the target entity based on the information about the target entity comprises comparing the target entity information received from the requesting entity computer to target entity information stored by the monitoring computing system to assign a persistent key to the target entity for monitoring;
• monitoring a periodically updated data set and determining a risk metric for the target entity based on monitoring the periodically updated data set;
• comparing the risk metric of the target entity to a threshold value;
• based on the comparison, generating a third identifier associated with the risk metric of the target entity;
• and
• storing, in a secure database of the monitoring computing system, a mapping of the second identifier to the first identifier and the third identifier to the first identifier and the second identifier;
• identifying a plurality of third identifiers corresponding to a subset of the plurality of target entities with indicators of an increased insider threat risk;
• providing the third identifiers to the requesting entity computer over the network;
• responsive to providing the third identifiers, receiving, from the requesting entity computer over the network, a request for a first identifier associated with a particular third identifier;
• using the particular third identifier and the stored mapping to identify the requested first identifier;
• providing the requested first identifier and the particular third identifier to the requesting entity computer over the network;
• and
• responsive to providing the first identifier, updating target entity information stored by a computing system to include a soft credit hit, wherein the monitoring of the periodically updated data set and the providing of the third identifiers to the requesting entity computer do not result in adding the soft credit hit to the target entity information stored by the computing system.