Insider Risk Perspective

Think about how much effort goes into deciding whether someone should be allowed into an organisation. Interviews, background checks, references, security clearances, approvals. Sometimes the process takes months.

Almost every executive I brief agrees that insider risk is important. They nod, ask a question, and thank me for my time. Then the meeting ends, the agenda moves on, and the risk remains unchanged.

An Australian parliamentary committee recently examined conduct in one of the country's most regulated environments. Codes of conduct exist. Behavioural standards are documented. Mechanisms for raising concerns are in place.

Passwords have been strengthened by multi-factor authentication. Single sign-on has simplified and centralised access. Biometrics, privileged access management and increasingly sophisticated identity controls have made it much harder for someone to simply pretend to be somebody else.

Whenever an insider incident occurs, the story remains consistent. Someone took action. They stepped over a boundary. They resulted in harm. The organisation reacts with surprise, begins an investigation, and works on remediation.

Trust is how organisations function. People are trusted with information. Leaders with authority. Suppliers with access. Technology with decisions. Without it, nothing moves.

It’s no secret that organisations are moving faster than ever to deploy artificial intelligence. However, governance is not.

Policies sit in folders. Leadership sits in the room. When a senior executive bends a rule, protects the wrong person, or turns a blind eye, everyone watching learns what truly matters. Not the code of conduct. Not the compliance framework.

One of the most common assumptions organisations make about insider risk is also among the most dangerous.

When organisations hear the words “insider risk”, they call their cybersecurity team. They review access logs, tighten permissions, invest in monitoring tools, and brief their security operations centre team. It feels like the right response, but it is the wrong starting point.

Your dashboard is green. Your metrics are trending in the right direction. Your board pack shows coverage, incidents logged, and response times within tolerance. Everything looks fine.

Your acceptable use policy exists. Your data handling policy is documented. Your incident response plan is approved and filed. Yet insider incidents still occur in organisations that have all of them. The reason is straightforward: Policies create expectations. They do not create detection, escalation, or the judgement to act when something feels wrong but is not yet undeniable.