Think about how much effort goes into deciding whether someone should be allowed into an organisation. Interviews, background checks, references, security clearances, approvals. Sometimes the process takes months.

Almost every executive I brief agrees that insider risk is important. They nod, ask a question, and thank me for my time. Then the meeting ends, the agenda moves on, and the risk remains unchanged.

Having an insider threat program is one thing. Making it work is another. This paper explores five considerations that help organisations move from individual measures to an effective insider threat capability. If you need a shorter version for card layouts: Trust underpins every organisation, yet it cannot be seen or touched. How well does your organisation understand the trust it depends on?