1. A system for automated insider threat prevention, comprising: a processor of a network device configured to: monitor network communications at the network device, wherein monitor network communications at the network device comprises: monitor encrypted network communications between a client device and an external site, wherein the encrypted network communications are encrypted using a first protocol; decrypt the encrypted network communications between the client device and the external site; and determine if the encrypted network communications between the client device and the external site include a file transfer activity from the client device to the external site; detect an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user, wherein the anomalous activity includes an anomalous file transfer activity associated with the user, and wherein the anomalous activity is determined to be suspicious based on one or more file transfer application activities associated with the user based on a threshold comparison with the behavior profile for the user; perform an action in response to the detected anomalous activity based on a policy, wherein perform the action in response to the detected anomalous activity based on the policy comprises: throttle the anomalous file transfer activity; and receive a notification associated with another anomalous activity associated with another user, wherein the another anomalous activity is detected based on monitored network communications associated with the another user based on another behavior profile for the another user; and a memory coupled to the processor and configured to provide the processor with instructions.