The insider threat has traditionally been viewed as a high-consequence but low-frequency risk, and many IT organizations have found it challenging to develop effective programs that manage that risk.
In my opinion, since 1989, the SEC has largely abandoned the meaningful oversight of systemic risk to the markets from high frequency trading, algorithms, and the like.