A supervisor notices a clerk emailing large case exports to a personal address at odd hours without a business need. Which awareness theme does this scenario highlight for training?

Anomalous behavior recognition teaches users and managers to notice risky, unexpected, or unintentional actions that may indicate error, policy violation, or insider risk. Training should emphasize escalation through approved channels rather than informal accusation. Early recognition supports investigation and harm reduction in civic workplaces.