The Problem Starts After Access Is Approved
Think about how much effort goes into deciding whether someone should be allowed into an organisation. Interviews, background checks, references, security clearances, approvals. Sometimes the process takes months.
Eventually, everything is approved. The person receives their credentials, gains access to the systems they need, and starts doing their job.
From that point onwards, something interesting happens.
We tend to focus less on the decision we have just made, even though the person's circumstances, responsibilities and access will continue to change.
That is where the real risk begins.
Access is not the same as trust, and granting it is only the beginning of an ongoing responsibility. Once someone is inside the organisation, things rarely stay the same. Their role changes. Their access grows. They gain authority, relationships, visibility and influence.
The organisation around them changes too: Restructures, new systems, new pressures, and new opportunities to move information. Technology makes it easier than ever to access, copy, share, and remove data. External actors are increasingly focused on people who already have legitimate access.
The person may still be the same one you cleared, but the conditions under which they were trusted have changed. That is important because insider risk can increase even when a person's intentions remain unchanged. Someone may be entirely trustworthy yet acquire excessive access, become vulnerable to manipulation, make an unintentional mistake, or be placed under pressure.
That is the core problem. Organisations spend enormous effort establishing access and far less effort understanding what happens after it is extended.
I see this pattern repeatedly. A manager knows who has access. They know what systems people use. But ask them five specific questions, and the answers may be less certain than they first appear.
What trust have we actually extended?
Not just who has a login, but who has authority, influence, visibility into sensitive information, or the ability to approve, modify, override or move things with little scrutiny. Access is more than credentials. It is opportunity.
What are we verifying after approval?
Vetting and clearance are snapshots in time. They tell you something about the person at that moment. They do not tell you whether the access you extended last year still matches what that person can do today. Roles drift. Privileges linger. Contractors finish projects but retain access. People move into new functions and carry old permissions with them.
Would we recognise meaningful change?
Changes in circumstances, behaviour, performance, working patterns or relationships can be relevant when considered in context. However, personal difficulty alone is not an indicator of insider threat. The organisation's challenge is to understand context, identify relevant combinations of indicators, and respond proportionately. That requires appropriate governance, privacy safeguards and human judgement, not just monitoring.
Can we see when legitimate access becomes harmful?
This is the hardest question. The activity often looks normal. Valid credentials. Authorised systems. Approved processes. The difference between appropriate and harmful activity often lies in the circumstances, purpose and consequences of that activity. A technical alert alone may not reveal that distinction.
Can we act?
If a concern arises today, who owns it? Who gathers information? Who decides whether intervention is proportionate? Who talks to the person, reviews access, manages legal risk, protects wellbeing, and communicates with leadership? If these responsibilities are not pre-defined, the first hours are lost to confusion, defensiveness and fragmented ownership. In that delay, evidence disappears, harm continues, and trust in the process collapses.
These five questions provide a practical test of how well an organisation understands the trust it has established.
Middle managers are where this test is usually passed or failed. They sit between policy and reality. They see behaviour, pressure, access and change more directly than most senior leaders. They are also the ones most often left without clear guidance on what to notice, what to report, and what happens next.
The challenge goes beyond knowing who has access. It requires understanding what that access enables, recognising when circumstances change, and ensuring the organisation can respond effectively. That requires more than policies, permissions and monitoring. It also requires clarity on who owns the risk, how concerns are recognised and how decisions are made.
The real question is whether the organisation continues to understand, verify and manage the trust it has extended as circumstances change, because approving access is only the beginning of the responsibility.