Beyond catching malicious insiders, Orion also distinguishes between human errors and external attackers for specificity.