Insider Threat Detector

Removes the account conditions that make credential abuse easy: dormant accounts that are still enabled, password-policy exceptions and disabled accounts that were never deleted.

The Insider Threat Detector skill uses Lansweeper Active Directory user data to find the account conditions that make credential abuse easy. It flags enabled accounts that have gone dormant, password-policy exceptions such as never-expires, expired and not-required, and disabled accounts still waiting to be deleted, with breakdowns by department and employee type and a named-account risk register. It is built for access reviews and SOC 2 or ISO 27001 preparation. It does not detect attacks in progress, and it cannot report group membership, privileges or failed logons because the directory data does not expose them.

image 217

Why the Insider Threat Detector Skill Matters Here

  • IT perspective

    “Which stale or exception accounts can I disable or reset now?”

    • Dormant-but-enabled accounts and password exceptions are listed for action.

    • Disabled-not-deleted accounts are counted as cleanup debt.

  • Security perspective

    “Which enabled accounts could an attacker use without anyone noticing?”

    • Accounts idle for 90 or more days but still enabled are surfaced first.

    • The output works as an account-hygiene pack for SOC 2 and ISO 27001 preparation.

Beta

Lens Workbench

Ask your asset data a question. Get a straight answer.

Lens Workbench is a dedicated space where you can ask questions about your asset data and get straight answers, build live reports that stay current, connect your existing tools through MCP connectors, and take action directly, like adding or retiring an asset.

Sign up

Requirements

Lansweeper MCP

https://mcp.lansweeper.com/mcp

Lansweeper plan

Starter, Pro, Enterprise

LLM

Claude 3.5+, ChatGPT, Gemini (Antigravity), Copilot, Lens Workbench (closed beta)

Step by step setup guide

Step 1: Download
Download the skill package for your platform. Lens Workbench users can skip this step.

Step 2: Install

  • Claude: install as a skill in Claude Desktop or Claude Code.
  • ChatGPT: add the skill to your ChatGPT (Codex) skills folder.
  • Gemini (Antigravity): load the skill into your Antigravity agent’s skill folder.
  • Copilot: add it as a skill in GitHub Copilot, or import it into Copilot Studio.
  • Lens Workbench: request access to the closed beta at Lansweeper Beta Program. Once you have access, the skill is already in the workbench.

Step 3: Connect Lansweeper
The skill needs your Lansweeper data to return results.

  • Claude: connect the Lansweeper MCP connector and sign in.
  • ChatGPT: connect Lansweeper MCP, EU or US endpoint based on your tenant.
  • Gemini (Antigravity): connect a Lansweeper MCP connector separately; Gemini doesn’t ship one built in.
  • Copilot: connect the Lansweeper MCP connector to your agent.
  • Lens Workbench: select the site(s) you want to run the skill on.

Step 4: Ask

  • Claude: “How many accounts haven’t logged in for 90+ days but are still enabled?” or “Access review and SOC 2 prep: give me the account-hygiene pack.”
  • ChatGPT: trigger with $insider-threat-detector or “Access review and SOC 2 prep: give me the account-hygiene pack.”
  • Gemini (Antigravity): “Show accounts with expired passwords that are still enabled.”
  • Copilot: “Which accounts have password never expires set?”
  • Lens Workbench: type /insider-threat-detector in the prompt box.
Related Skills
See all skills