Detecting Insider Threats: Lessons from the Front Line