Introduction
In November 2025, Pentagram Advisory Pty Ltd (Pentagram) decided that there was a need to provide a focused event to inform Australian critical infrastructure entities, along with other private and public sector organisations, about insider threat. At that time, Pentagram’s co-founders had been working with Australia’s critical infrastructure sectors, as designated in the Commonwealth’s Security of Critical Infrastructure Act 2018 (SOCI Act), for over three years. This experience motivated Pentagram, in collaboration with Fivecast, to stage the inaugural National Insider Threat Forum in Sydney on 11 June 2026.
Pentagram knew from its years of running online SOCI workshops, its client engagements, human science research from many countries, feedback from the Department of Home Affairs, and the frequency of insider threat cases being reported in Australia and overseas that insider threat, as a component of the personnel security hazard described in the SOCI legislation, was not well understood and not meaningfully treated in many critical infrastructure and other entities.
So what, you might say? Why should organisations pay attention to the insider threat, whatever that is? Isn’t cyber security by far the most important protective security risk to mitigate?
All good questions.
Cyber has been the pre-eminent threat vector since the SOCI legislation first appeared in 2018 and it remains the most discussed and funded hazard for good reason – cyber-related security incidents are abundant and can have catastrophic consequences. Pentagram does not argue that personnel security should supplant efforts to identify and mitigate cyber risk. Rather, Pentagram sees that personnel and cyber are symbiotic – good cyber security relies on people inside an organisation – and that, together, people and cyber present the largest and most consequential attack surface that critical infrastructure and other entities have. Cyber and human-based threats are intertwined.
Pentagram’s assessment is that understanding and mitigating human-based sources of harm is neither well understood nor sufficiently mitigated. Mitigating human-based sources of harm requires significantly less investment to achieve a high value security effect than cyber security does.
National Insider Threat Forum Agenda
The Forum agenda was split into two parts. The morning session explored Australia’s risk context and analysed what the insider threat is. The afternoon session explored approaches and tools to identify and mitigate insider threat as part of an enterprise risk management program.
The opening session, exploring what world events mean for Australia – was delivered by Marc Ablong of Geostrategic Risk Partners. Marc opened with the statement that Australia is currently at war, the context being that hostile nation states are attacking Australia every day with actions short of overt military action.
Marc explained that Australia is living in an era of significant geostrategic risk, more so than any time since 1945, nominating five forces reshaping Australia’s strategic environment.
- geopolitical and ideological contest
- concurrent global conflicts
- Indo-Pacific competition
- emerging and disruptive technology
- climate and resource disruption.
Marc’s closing observation was:
Every day, Australia endures a form of war that blurs the lines between peace and conflict. It unfolds through trade sanctions, cyberattacks, disinformation, and the contest for critical materials.
This is the new battlespace of power: economic, informational, and psychological.
The undeclared war is everywhere, and every Australian has a part to play.
Mr David Chick, Assistant Secretary, Risk Assessment Branch from the Department of Home Affairs, spoke about the Commonwealth’s view of insider risk to critical infrastructure.
David cited the ASIO Cost of Espionage Report 2025 which stated that insider threats involving state or state-sponsored actors cost Australian businesses up to $324 million in 2023-24.
David cited the Ponemon Institute’s 2026 report on global costs of insider risk recording that 53% of insider incidents are from negligence, 27% are malicious, and 20% are from people being deceived.
David explained that Home Affairs has assessed that the vulnerability trends for insider risk are:
- increasing reliance on contractors, vendors, or other third-parties
- digital technology increasingly expanding the attack surface
- generative AI and false content.
He also offered a process for critical infrastructure entities to identify their critical workers by, sequentially, defining the proper function of a position, identifying critical sites, and identifying critical components all of which results in the identification of a critical worker.
Next, Pentagram’s Tim Slattery explained that Australia has, since its claiming by the British in 1770, been constantly subject to an array of geopolitical risks so there is nothing new about the risky situation that Australia is now confronted by, as Marc Ablong had explored in the opening presentation.
Tim explained how the drivers of geopolitical threat can influence and affect people, and may manifest in their workplace behaviour, which could include insider threat behaviour.
People are a unique threat source because people change, potentially in an instant, and those changes may be driven by geopolitical or local domestic events. People are the most challenging threat source because they can form intent and have the capability to act. The other SOCI threat vectors of cyber, supply chain, and physical and natural are not equipped to have intent. People can observe evolving mitigations and identify how to circumvent them in an effort to cause harm. People’s ability to think, respond, adapt and act makes them the most challenging threat to identify and mitigate.
For example, you may have an Iranian expatriate in your workplace who has been a model employee. However, as a consequence of strained relations between Australia and Iran in recent years, that Iranian person may be approached by Iranian agents and be coerced into harming your workplace, to becoming an insider threat albeit against their will. Iranian agents may threaten the wellbeing of family in Iran or in Australia of the person and so they feel they have no choice but to undertake the insider threat act to keep their family safe.
A person’s history of secure and positive workplace behaviour does not guarantee their behaviour won’t become aberrant in the future.
The next presentation of the morning session was from Dr Eric Lang, Chief Human Science Officer at Prosocial Science International who joined the Forum via Teams from the United States. Eric’s presentation was titled Science-based Insights and Recommendations to Improve Insider Threat Programs.
Eric opened with two key points, drawn from credible international studies and analysis:
- Technology-dependent insider threat programs often show limited effectiveness, reducing only a small proportion of an organisation’s overall insider threat problem.
- The biggest insider threat program gaps and improvement opportunities centre on addressing psychological and social factors.
Eric explored insider threat from the perspective of human sciences. What scientific studies, robust analysis and workplace experience tell us about insider threat. This information provides strong guidance to inform approaches to successful insider threat mitigation.
Eric made clear that insider threat is an inherently human behavioural matter.
Other key points from Eric’s presentation include:
- Because motivations, behaviours and influences vary across areas, there is no reliable and valid social science model for predicting an individual insider threat in a specific timeframe.
- Using the example of data breaches, unintentional insiders (that is, insiders who make a mistake or are negligent) contribute to approximately 95% of data breaches. Research shows that reducing mistakes from negligent insiders will also decrease data breaches from malicious insiders and external attackers.
- Eric set out ten factors that are known to lead insider threat programs to falter. The five factors that are the most difficult to ‘fix’ all relate to workplace culture, communication, training and education, and engaging staff so that they see they have a role and an equity in the success of the insider threat program.
- The success of an insider threat program, of engaging the workforce and winning their trust and support for the program, depends overwhelmingly on leadership. Direct supervisor performance is critical for success. About 70% of team engagement is determined by the quality of direct supervisor performance. A UK Government study found that 69% of people said their direct manager impacted their mental health, an impact higher than anyone else in their lives such as a doctor, except for spouses / life partners who also scored 69%.
Overall, Eric made clear that successful management of the insider threat is a human factors activity in which leaders, from direct supervisors to executives to the board, must engage effectively and constructively to enable ongoing success.
The final morning presentation was from Anders Spalding, of the Swedish company Spalding Security Solutions, who explained the insider threat situation in Sweden.
Like Australia, Sweden has been slow to understand the significance of the insider threat, in terms of both national security (in public and private sectors) and the protection of critical infrastructure. And this is despite Sweden being a target of Soviet, and subsequently Russian, espionage and coercion since the 1940s and with many recent cases of insider threat being discovered.
To show how prescient the insider threat is, the Swedish government from 1943 has produced a civil defence pamphlet titled “If the War Comes” to help citizens plan their survival actions. In 2024 the pamphlet, now titled “If Crisis or War Comes” was greatly expanded and reissued to every Swedish household due to the heightened security situation in Europe and Sweden’s NATO membership. Sweden has a mature approach to civil defence, yet it still seems slow to grasp the need to consider and mitigate the insider threat. Just like Australia.
Anders shared with the audience, drawing on his experience as a military counterintelligence officer, his understanding of human intelligence and elicitation techniques – some in the audience were very interested in this topic. Anders demonstrated to the audience some basic elicitation techniques. Showcasing these techniques to employees will awaken them to such behaviour, offering them a layer of protection to recognise elicitation techniques being practiced upon them, thus protecting them and helping to mitigate the risk of insider threat to an organisation.
Anders concluded by observing that, in terms of recognising the risk posed by the insider threat, his months in Australia during 2026 have showed him that Sweden and Australia are similar in that they both have abundant signals that insider threat abounds but are yet to focus sufficient attention on mitigating it.
The afternoon session built on the exploration of insider threat – what drives it and how insider threat manifests as a workplace risk – by focusing on solutions to mitigate the risks posed by insider threat.
The first afternoon session was delivered by Duane Rivett, co-founder of Fivecast.
Duane explained what open source intelligence (OSINT) is. He set out how Fivecast, in its development and provision of unique OSINT capability, enables a user to undertake a targeted exploration of open source data and information, spanning the public internet down in to the dark web, to discover information of relevance to their security needs.
Duane set out some use cases that Fivecast clients globally use its tools for. Fivecast’s clients, mainly in the United States, Western Europe, the United Kingdom, and Australia include large government agencies and private sector clients. Use cases include border security, extremist threats, fraud detection, security vetting, and insider threat. With respect to the latter two use cases, Fivecast tools are used by the Australian Government Security Vetting Agency to support Commonwealth protective security.
Duane explained that OSINT is legal. OSINT does not ‘break in’ to personal communications, requires no legal warrant, can be used legally in Australia. It identifies and collects information and data that is in the public domain, albeit often not easy to find or accessible only through specialised tools and techniques such as those contained in Fivecast’s products.
A necessary feature of an OSINT capability is the protection of the searcher’s identity. Fivecast’s various tools all protect the searcher.
Pentagram sees OSINT as a high-value, perhaps essential, component of an Insider Threat Program.
Next, Pentagram Advisory’s Marina Shteinberg explained Pentagram’s Trusted Workforce Program as a solution to mitigate insider threat.
The Trusted Workforce program approach treats all phases of the employee lifecycle:
- pre-employment
- onboarding
- ongoing
- offboarding
- post-employment.
Marina explored the meaning of ‘trust’ in a workplace context, offering that in employing a person we are not just choosing them, we are authorising trust in them. Every hiring decision is also a security decision, whether we treat it that way or not.
Marina explained that there are three interconnected levels of risk when employing a person: enterprise security risk, role or position risk, individual suitability. Organisations can struggle with effective workforce screening because these three levels are often blurred or collapsed into a monocular approach.
The seven risk factor areas that should be applied to candidates and employees, as per Australian Government vetting and Australian standards, were listed and described, those being:
- External loyalties, influences and associations.
- Personal relationships and conduct.
- Financial considerations.
- Alcohol and drug use.
- Criminal history and conduct.
- Security attitudes and violations.
- Emotional and mental health considerations.
Marina explored what can be done to obtain information about people who are not Australian citizens or are resident overseas. OSINT is an enabler for this task.
The presentation also addressed the issues of the psychological contract between an organisation and a person, tools for managing ongoing suitability, the risks embedded in offboarding and post-employment, research showing that many leaders are in denial about the risk posed by the insider threat. That research, by Michael Robinson at Google, offered the following quote which I think neatly sums up the need for a Trusted Workforce Program to address insider risk:
“Everyone thinks they understand insider risk. But the data shows otherwise. We’re making decisions based on anecdotes instead of evidence.”
The next presentation explored the Insider Threat Program. Pentagram Advisory’s Tim Slattery described the ‘insider’, citing ASIO’s definition: a current or former employee or contractor (including supply chain vendors) who has legitimate or indirect access to a workplace’s people, information, techniques, activities, technology, assets or facilities’. Tim then listed some common insider threat behaviours and indicators.
Tim then used a short audio-visual presentation spanning 44 BC, the assassination of Ceasar, to the 2025 ‘Bankstown nurses’ cases in Australia, to showcase that insider threat behaviour is endemic to the human species. The point being that insider threat behaviour, in some form, is likely occurring in every workplace today and definitely will occur in the future.
Tim explained that in the workplace setting there are threats ‘to’ and ‘from’ people. The threats ‘to’ people come from many directions including the geopolitical risk drivers that Marc Ablong had set out in the first presentation. These drivers can load great stress onto people, perhaps in the form of cost-of-living stress due to increased fuel prices stemming from the war with Iraq, or a Jewish person feeling threatened by anti-Israel protest action, or a person of Chinese ethnicity being coerced by Chinese intelligence to commit an insider threat act.
People come to work wearing their ‘work mask’. Often, they hide from the workplace the stressors in their private life. Which of course is appropriate, however they do bring their ‘whole person’ to work. They cannot isolate everything else going on in their life from their workplace behaviour. Because of this fact, leaders need to be alert to the geostrategic risks that are impacting Australia, consider how these impact Australia and how that may manifest as stressors upon their workforce, and suppliers.
The Pathway to Insider Risk was explained. This psychological model, developed by American researchers Shaw and Sellers in 2015, is accepted by the government security vetting agencies in the United States, Australia and other allied countries as a valid model through which to understand insider threat behaviour.
Tim then showed the model of Pentagram’s Insider Threat Program, explaining it in terms of insider threat mitigation that the Trusted Workforce Program described previously by Marina. The Trusted Workforce Program enables the building of a workforce that understands protective security and incorporates that understanding into all facets of the workforce to deliver a productive workforce with culture that looks out for the interests of individual workers, colleagues, the enterprise, and all its stakeholders. The Insider Threat Program becomes the assurance mechanism that enables an organisation to assess how well its trusted workforce is operating. The two Programs together can be seen as two sides of a coin.
Pentagram’s Insider Threat Program has ten steps. The foundational step is ‘executive buy-in’ or, put another way, leadership. The organisation’s leaders must acknowledge the insider threat is real, that it requires mitigation, that an Insider Threat program is that mitigation solution, they must explain the program and continually advocate that position to their workers, and they must resource and support its enduring operation.
If there is lacklustre leadership then the program will likely fail. This is the same point that Eric Lang had made earlier in the day.
Tim explained there is no single approach to an Insider Threat Program. The concept and model can be grafted into the current organisation so that it fits as naturally as possible with the minimum of disruption. The Trusted Workforce Program can contain features of the Insider Threat Program. For some organisations a Trusted Workforce Program with some special focus on Insider Threat Program features may be the most appropriate solution.
In closing, Tim referred to the axiom put by President Ronald Reagan in the 1990s when negotiating nuclear arms limitation agreements with the Soviets: Trust but Verify. This is a sound approach to fostering a trusted workforce, one that minimises the risk posed by insider threat but can also identify insider threat behaviour.
The next agenda item was a ‘fireside chat’ between Lauren Veenstra from Iberdrola and Mark McConnon from TasWater. Lauren and Mark discussed the challenges that organisations face in implementing personnel security measures brought by the SOCI Act, especially with respect to insider threat.
Their comments were emblematic of those Pentagram has heard from other clients and contacts. The SOCI Act personnel hazard is not well understood. Home Affairs’ guidance has been insufficient. The term ‘insider threat’ is too threatening to use in the workplace. Unions are opposed to insider threat programs, and to the use of OSINT to monitor ongoing employees. Leaders do not understand, nor really want to engage, in discussion about insider threat.
All those points are valid. Pentagram’s purpose in convening the National Insider Threat Forum 2026 was to bring people together and provide them information and insights into the risk posed by the insider threat and what might be done to mitigate it.
The final presentation saw the return of Marc Ablong to explain the need for national resilience. By way of context, Marc did say in his presentation at the beginning of the Forum that Australia was at war, and had been for some years. So national resilience is an issue when crises strike. Certainly Anders’ presentation about Sweden and its level of civil preparedness in case of war or other crisis, for many decades, connects to this point.
Marc quoted that Australia faces “The highest level of strategic risk we have faced as a nation in 80 years – and the warning time has gone.”
In terms of Australia’s resilience position today, Marc offered a gloomy synopsis:
- Australia’s institutions (private and public) are designed and operate for a more predicable strategic age. We are not now equipped for the geostrategic risks we face.
- Many of the biggest vulnerabilities have no clear risk owners.
- Vital functions straddle Commonwealth, States, industry with little or no binding framework to enable crisis response outcomes.
- Crisis structures that do exist tend to react once we are in crisis – we lack preparedness and pre-emption capabilities.
Marc assesses that by 2030 Australia needs to:
- Transform to a ‘total defence’ setting which combines Defence, community, civil society and industry to maintain and defend Australia.
- Act to realise the reality that economic security is national security. Australia needs sovereign capability in areas such as liquid fuel processing, select high-technology manufactures, critical minerals and more.
- Trust as infrastructure. Civil cohesion, robust and reliable institutions, and secure supportive workforce that people want to be part of.
That brought the event to a close.
In reviewing the presentations, concepts and information provided throughout the day Tim suggested that the attendees got more than they anticipated and much food for thought (nods around the room).
The Forum was not a bland doctrinal exploration of insider threat. The Forum was much more. It explained that anyone can be an insider threat. That person is highly unlikely to have joined an organisation for the purpose of harming it or its employees, and they may have a faultless employment record spanning many years, but through negligence or intent any person can be an insider threat.
The Forum presented a substantial line of evidence that Australia’s workforce of citizens and non-citizens is under uncommonly high and sustained stress, subject to an enormous array of geopolitical risk drivers. In turn, these stressors, perhaps coupled with a personal stress such as debt or illness, can drive people to behave in ways that they have not before either at home or in the workplace. And because the ‘whole person’ comes to work then we must anticipate, as Eric Lang explained, that their behaviours can and do lead to incidents of insider threat.
To mitigate insider threat, it needs to be understood. Then an assessment can be made as to the level of risk it might impose. If mitigation is required then leaders need to make that decision, to champion it and talk about it so that people understand the benefit and support the efforts to mitigate insider threat.
Like Reagan’s nuclear weapons approach, the best Insider Threat Program never needs to result in the worst outcome – treating the consequences of a highly consequential insider threat event – but it provides necessary assurance. As the old sporting saying goes, offence is the best defence.
In insider threat speak, Pentagram believes that a Trusted Workforce Program, with an integral OSINT capability, is the best approach because it does not present as a security ‘stick’ but rather as a security carrot that invites workers to play a role in the security and business success of their workplace. This approach sees all stakeholders benefit, creating the psychologically safe space for people to report aberrant workplace behaviours. That act may mean a person is stopped from becoming an insider threat. Perhaps receiving the help they need but were not able to ask for.
Key takeaways from the Forum:
- Insider threat is a topic that is important, relevant, and needs to be talked about.
- Insider threat is an intensely human risk. Accordingly, humans have the most significant role to play in a successful Insider Threat Program. Technology has a supporting role, but it is the humans that will bring success.
- Leadership on insider threat is essential. Leaders need to be aware of it, understand what drives it, see that it is integral to achieving business outcomes, recognise it is part of their workplace health and safety duty of care.
- The government has done all it will do by creating SOCI legislation with some related guidance. It is the responsibility of critical infrastructure entities to do more than the minimum to mitigate insider threat, they need to do it to bolster and maintain the security of their assets and operations.
In closing, here is a comment provided by a person who attended the National Insider Threat Forum. Pentagram knows the person well: they are not prone to giving praise lightly.
“This was one of the most productive and useful events I’ve attended. It was informative and focused on practical solutions not just studying the beauty of the problem. It will be a foundation for the development of our [insider threat] program.”
If the National Insider Threat Forum 2026 motivates and assists just one critical infrastructure entity to implement an effective Insider Threat Program then I say it was a job well done.
We hope to welcome you at the next National Insider Threat Forum in 2027.