When Tracey Mitchell first walked into the Defence Signals Directorate more than three decades ago, the world of personnel security was a very different place. ‘Back then, everything was paper based’, she recalls with a smile. We’d sit in rooms surrounded by stacks of files, manually piecing together someone’s background. It was meticulous work but very slow’.

Karen Bradley’s early experience mirrored Tracey’s. “The process has always been about assessing key character traits—honesty and integrity, loyalty to Australia’s democratic values, trustworthiness, maturity and judgement, resilience and stability, tolerance, and vulnerability to undue influence,” she explains. “But our world has changed. Today, factors like technology, artificial intelligence, and global connectivity add layers of complexity that simply didn’t exist back then.”

The tools were far less sophisticated, processes rigid, and while continuous evaluation of a person’s suitability has always existed, it wasn’t emphasised as a shared responsibility. Today, protecting Australia’s national security means making that responsibility collective—security professionals, organisations, and individuals all play a vital role.

Fast forward 35 years, and the personnel security industry has transformed beyond recognition. Technology, globalisation and evolving human related threats have reshaped how we think about personnel security and Tracey and Karen have been at the heart of that change.

The Birth of MPS: A Vision for Better Standards

By 2006, Tracey and Karen saw a gap in the market. ‘We wanted to lift the standard of personnel security across Australia’, says Karen. That vision became Mitchell Personnel Solutions, one of the first outsourced security vetting providers in the country. Their mission was clear, bring consistency, quality and integrity to a critical function that underpins Australia’s national security.

Their journey wasn’t without challenges. ‘When we started, outsourcing vetting was a new concept for the Government’, Tracey recalls. ‘We had to build trust, not just with clients, but with an entire industry’, Over time, they worked with more than 20 government departments and agencies, including members of the intelligence community, setting a new benchmark for personnel security excellence.

Tracey’s career had already been marked by innovation. In 2004, she was seconded to the Attorney-General’s Department to establish the Australian Government’s National Security Hotline, a critical initiative that gave Australians a direct line to report suspicious activity. ‘It was about empowering the public to play a role in national security’, she says. ‘That was a turning point for community engagement’.

From Vetting to Vigilance: The Rise of Insider Threat Management

For decades, personnel security was about who you were when you joined the organisation. Now, it’s about who you are every day. The emergence of insider threats, whether malicious or accidental, has changed the game.

Karen explains, ‘An insider threat isn’t always a foreign spy or a saboteur. It can be an employee under stress, someone making poor decisions, or even a well-meaning person who clicks the wrong link. The risk is dynamic, and so our approach must be too’.

This shift has driven the development of principle-based frameworks that focus on human behaviour and decision-making. Instead of relying solely on background checks, organisations now use continuous evaluation, behavioural indicators, and risk-based assessments to detect early warning signs.

Techniques That Make a Difference

Modern insider threat programs combine data analytics with human insight. Some key techniques include:

• Behavioural Monitoring: Identifying changes in patterns. such as unusual access to systems or sudden financial stress.
• Psychological Safety and Reporting Channels: Encouraging employees or contractors to speak up without fear of reprisal.
• Training and Awareness: Moving beyond compliance to create a culture where security is everyone’s responsibility, and regular insider threat awareness training is provided to employees and contractors (at least annually).
• Cross-Functional Teams: Bringing the human resources, IT, legal, compliance and security teams together to manage insider risk holistically.

Tracey and Karen’s new company, MPS People Security Risk Management has been leading this charge. Their Insider Threat Practitioners Course equips organisations with practical tools to identify, assess and respond to insider risks. ‘It’s about giving people the confidence to act early’, says Karen. ‘Prevention is always better than response’.

Looking Ahead

As Tracey reflects on the journey, she smiles. ‘When I started, I never imagined we’d be talking about behavioural analytics and AI-driven risk models. But at its core, personnel security is still about trust, just with better tools and deeper understanding’.

Karen agrees. ‘The future is about people. Technology helps, but culture is what keeps organisations safe’.

• LinkedIn
• Instagram
• Facebook
• YouTube