Canadian analytics company Interset uses machine learning and pattern recognition to flag this sort of anomalous behavior, often the precursor to intellectual property or data theft. Originally focused on secure file sharing and audit trail reporting, the company (formerly FileTrek) just disclosed another $10 million in funding to expand its advanced threat detection capabilities. The lead investors are Toba Capital and software company Informatica.

“If you can understand the normal patterns, you get a fingerprint of how people work,” said Interset CEO Dale Quayle. “We look for the anomalous behavior that could signal a change.”

One customer, a semiconductor manufacturer that owns thousands of patented processes and technologies, used Interset’s software to uncover a coordinated theft involving more than a half-dozen contractors who were copying upwards of 500,000 files daily. (The investigation is ongoing, so the company prefers to remain anonymous.)

Interset’s behavioral analytics technology is installed alongside a company’s existing data sources, where it correlates information and seeks patterns. It is priced as a subscription: about $50 per year per monitored data source, Quayle said.

Alerts about potential threats are sent to security teams in natural language so they are easy to comprehend. That’s a big plus for under-resourced organizations, said Paul Calatayud, chief information security officer for healthcare software company Surescripts. His company has used Interset’s software for about six months.

“We can define what good behavior looks like and then block everything else. … When someone steps out of the norm, then that is what my team investigates,” Calatayud said.

Interset previously disclosed a $10 million Series B round in 2012, led by Anthem Venture Partners, Telesystem, and Ontario Emerging Technologies Funds. Quayle previously led data center management company Integrien, sold to VMware in 2010.

Sign up for Data Sheet, Heather’s daily newsletter about the business of technology.