The $19.5 million insider risk problem