Techniques for automated insider threat prevention are disclosed. In some embodiments, a system, process, and/or computer program product for automated insider threat prevention includes monitoring network communications at a network device; detecting an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user; and performing an action in response to the detected anomalous activity based on a policy.