Monitoring privileged activity is critical. This includes logs, session monitoring, screen recording, keystroke logging, and even application monitoring. Why? Well if an Insider is accessing a sensitive system to steal information, session monitoring can document their access and how they extracted the information and when.