In a landmark webinar hosted by Michael Sharpe, the AUKUS Forum convened leading experts to explore the evolving landscape of insider threats and strategies to mitigate risks to critical infrastructure and national security. The session brought together MPS People Security Risk Management, Dr Eric Shaw, and DTEX, providing participants with actionable insights for organisations managing sensitive operations, particularly in the defence sector.

The Insider Threat Landscape Today

Karen Bradley, co-founder of MPS and leader of its People Security Risk Management team, opened the discussion by highlighting how the modern insider threat environment differs significantly from previous decades. Unlike the Cold War era, today’s threats exploit digital oversharing. LinkedIn profiles revealing security clearances or AUKUS project involvement create a “recruitment pipeline” for adversaries. According to ASIO, 24 major operations have been disrupted in just three years, representing an estimated $12.5 billion in annual economic impact. Modern threats can cascade across multiple sectors—including energy, healthcare, transport, and communications—while foreign intelligence services increasingly combine traditional human intelligence with cyber and social media capabilities. Bradley emphasised that insider threat management is now mandatory under the Protective Security Policy Framework (PSPF), rather than merely a best practice.

Bradley noted specific concerning behaviours, including public disclosure of security clearances, project details, sensitive facility locations, and role descriptions. Accepting connection requests from unknown individuals, posting photos from secure facilities, or revealing organisational structures online were also highlighted as high-risk practices. She cautioned that insider threats are not always malicious; they can include accidental data exposure, coercion by foreign actors, intentional theft, or well-meaning oversharing by employees unaware of the implications.

Critical Infrastructure and Shared Responsibility

The webinar also addressed the implications of the Security of Critical Infrastructure (SOCI) Act, which covers 11 critical sectors. Tanya Jefferis, MPS Chief Security Consultant and Trainer, emphasised that insider risk management is a shared responsibility. A breach in one sector can cascade to others, making proactive measures essential. Intelligence agencies provide threat intelligence while organisations must implement protective measures, conduct ongoing risk assessments, and report significant incidents. Jefferis urged organisations to move beyond checkbox compliance, embedding genuine insider threat capabilities across operations.

Effective Training and Executive Action

Jefferis detailed what effective insider threat training looks like, stressing the importance of role-specific programs that go beyond generic awareness sessions. Training should include realistic case studies, tabletop exercises, safe reporting channels, and ongoing reinforcement. Executives play a critical role by visibly supporting and resourcing insider threat programs. For leaders, Jefferis recommended immediate steps to mitigate risk: reviewing employee social media for potential exposures, deploying tailored insider threat training, updating role-based risk assessments, establishing confidential reporting channels, conducting realistic scenario exercises, and ensuring compliance with SOCI Act and PSPF requirements.

Innovative Frameworks and Technology Solutions

Dr Eric Shaw, a Washington DC-based clinical psychologist and former intelligence officer, introduced the Critical Pathway to Insider Risk (CPIR) framework. The CPIR-Index offers organisations a structured approach to assess and prevent insider threats. Shaw highlighted the benefits of using CPIR for early identification of risk factors, informed decision-making, and integrating behavioural analytics into security protocols.

Rajan Koo, CTO of DTEX, presented the InTERCEPT platform, which leverages digital analytics to detect potential insider threats proactively. InTERCEPT aligns with Australian Government requirements and provides early warning signs based on behavioural patterns. Koo discussed emerging trends in insider threat technology, emphasizing predictive analytics and privacy-first approaches that allow organisations to prevent breaches without compromising employee trust.

A Collaborative Approach

The webinar reinforced the importance of collaboration between government, industry, and technology providers. By combining expert insights, practical frameworks, and cutting-edge technology, organisations can strengthen their insider threat capabilities, protect critical assets, and foster a security-conscious culture.

Speaker Biographies (Abbreviated)

–  Karen Bradley: Co-founder of MPS, oversees the People Security Risk Management team, and develops comprehensive insider threat frameworks and training programs. 
– Tanya Jefferis: Security consultant with over 30 years’ experience across public and private sectors, specialising in security risk management, training, and governance. 
– Dr Eric Shaw: Founder and CEO of Insider Risk Group, author of the CPIR framework, and recognised expert in insider threat mitigation worldwide. 
– Rajan Koo: CTO of DTEX, leading development of the InTERCEPT platform, expert in cybersecurity and insider risk analytics, with over 20 years’ experience.

The webinar highlighted that managing insider threats requires an integrated approach: understanding human behaviour, leveraging technology, and embedding security practices across organisations. With expert guidance from MPS, Dr Shaw, and DTEX, Australian organisations and their AUKUS partners are better equipped to anticipate, prevent, and respond to insider risks in an increasingly complex digital landscape.

See the webinar here.

• LinkedIn
• Instagram
• Facebook
• YouTube