Many organizations realize they are at risk of insider attacks. But do they have evidence and capabilities to respond to these risks? That's the real challenge, says researcher Larry Ponemon.