# Insider Risk Management policies are enabled for risky AI usage
Until organizations use Insider Risk Management with Adaptive Protection, they could fail to detect insider threats, risky behaviors such as misuse of…
Source: https://maester.dev/docs/tests/ZTA.35038
:::note[Maester checks this too]
[MT.1174](/docs/tests/MT.1174) (Insider Risk Management policy for Risky AI usage is enabled.) checks the same setting. Running both reports it twice.
:::
## Overview
Until organizations use Insider Risk Management with Adaptive Protection, they could fail to detect insider threats, risky behaviors such as misuse of legitimate access to exfiltrate data, or unsafe AI scenarios where users expose sensitive data to large language models or unauthorized cloud AI services.
Insider Risk Management works with Data Loss Prevention (DLP) to combine user behavior signals with content-based rules, helping teams detect risks early and respond before sensitive data is exposed or compromised.
## Remediation
- [Create and configure Insider Risk Management policies](https://learn.microsoft.com/purview/insider-risk-management-policies?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
- [Help dynamically mitigate risks with Adaptive Protection](https://learn.microsoft.com/purview/insider-risk-management-adaptive-protection?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Data, AI |
| Category | Data Security Posture Management |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Insider risk management |
| Area | Logging and detection |
| ATT&CK | [T1213](/docs/tests?mitre=T1213) Data from Information Repositories |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.