Behavioral Modeling of Insider Threat, ARDA/DTO: BAMS ARDA applied artificial intelligence planning techniques to automatically generate malicious insider courses of action (COA) based on a collection of objective models including the network, physical environment, and user capabilities and skills. These COA could be used to evaluate defenses to insider attack, preposition defenses, and conduct what-if analysis and forensics. Because BAMS worked with a domain model that included cyber, physical, and social aspects, the result plans could mimic a wide range of techniques used by actual malicious insiders.