Insider threats are uniquely complex, they arise from trusted people who understand your systems and processes, can be accidental or malicious, and can cause outsized operational, legal or reputational harm. We design, develop and implement tailored Insider Threat Programs that convert best practice into practical, legally defensible capability, integrating governance, people, process and technology so your organisation can prevent, detect, respond to and recover from insider incidents.

What we deliver  
We deliver a complete, pragmatic program that starts with the organisation’s board or leadership team and finishes with operational routines that work in daily practice. After a rapid scoping phase to understand your assets, operating model and risk appetite, we establish executive sponsorship and define an Insider Threat Accountable Authority. We create a multidisciplinary governance structure that brings together HR, legal, IT and security and document the program’s scope, roles, decision authorities and performance indicators so responsibilities are clear and auditable. 

Risk-based Controls and Role Design  
Our approach begins with asset and job role mapping to identify who can influence critical systems and what harm they could cause. Using MPS People Security Risk Management Job Role Impact Assessments and scenario modelling, we translate risk into proportionate controls, job role-based screening and ongoing suitability checks, least privilege access models, separation of duties, privileged access approvals and tailored background check matrices. Every control recommendation is linked to a documented rationale so screening and access decisions are defensible and aligned to AS4811:2022 and other relevant industry best-practice standards. 

Detection, monitoring and Critical Pathway to Insider Risk (CPIR) 
We build multilayered detection that combines technical monitoring (user and network activity logging, anomaly detection) with human reporting and behavioural observation. The CPIR framework developed by Dr Eric Shaw, is operationalised to prioritise cases, focusing on observable behaviours and contextual stressors rather than medical diagnosis. Monitoring thresholds, triage rules and privacy safeguards are all defined so alerts translate into proportionate investigative actions that respect employee rights and legal obligations. 

Investigation, Forensic Readiness and Incident Response  
Our program codifies investigation pathways that preserve evidentiary integrity, describe lawful workspace search and device seizure protocols, and maintain chain of custody for both digital and physical evidence. The Insider Threat Incident Response Plan is integrated with business continuity arrangements so containment and recovery run in parallel. We also define escalation criteria for involving HR, legal, regulators or law enforcement and provide preapproved arrangements for external forensic and technical specialists to ensure rapid, capable response where internal resources are limited. 

Insider Threat People, Culture and Training  
Security is a human endeavour. We design awareness and role specific training, confidential reporting channels and policies that protect whistleblowers and encourage early reporting. Manager training focuses on recognising concerning behaviours, documenting observations, and following the procedural steps that begin effective investigations. Cultural measures are included to reduce stigma and support employee wellbeing as part of risk reduction.

Testing, exercises and continuous improvement A program without testing is a policy on a shelf. We run tailored exercises, from tabletop workshops to live red team sequences, to validate plans, escalation paths and forensic procedures. After every exercise or real incident we lead blameless post incident reviews that prioritise systemic fixes and produce an actionable remediation roadmap. We also provide maturity assessments and KPI frameworks so your leadership can track capability uplift over time and demonstrate due diligence. 

Deliverables and Implementation Support  
You receive a complete program package, including a governance charter, policy suite, rolebased screening matrices, incident response plan, evidence handling procedures, CPIR implementation guidance, training curriculum, exercise plans and a prioritized implementation roadmap with owners and timelines. We support rollout through stakeholder briefings, manager workshops and simulation exercises, and can remain on retainer to assist with incident surges or periodic reassessments.

Contact us for a confidential scoping conversation. We will outline a staged implementation plan that balances rapid risk reduction with longer term capability building and help you demonstrate to executives and auditors that insider risk is being actively managed.