Insider Threat – Looking at the ‘Whole Person’
In Australia’s National Interest - Security of Critical InfrastructureShow Notes
In this episode, we explore why understanding the whole person is essential to managing insider threats across Australia’s critical infrastructure sectors. Drawing on decades of national security experience, the discussion examines why insider threat remains one of the most complex and misunderstood challenges under the Security of Critical Infrastructure Act 2018 (SOCI Act). We unpack the behaviours, vulnerabilities and coercive pressures that can turn a trusted insider into a threat, the realities of foreign interference, and the importance of moving beyond simplistic assumptions about ‘rights’ and workplace culture. The episode also highlights why a whole-person approach to personnel security is not only effective, but necessary for organisations seeking to build a trusted workforce. This episode is based on an article by Tim Slattery, who served 37 years in Australia’s defence, intelligence and national security community before moving into consulting. Tim now co-leads Pentagram Advisory, with a focus on insider threat mitigation and personnel security across government, industry and critical infrastructure. If you work in protective security, critical infrastructure, risk management or insider threat programs, this episode provides practical insights into one of the most pressing and least understood challenges facing Australia today.
More from In Australia’s National Interest - Security of Critical Infrastructure
This video explores the Albanese Labor Government's agenda, from 2023 to 2026, to change the discussion about superannuation funds holdings from compulsory investments that must deliver maximum financial benefit to the fund holders to be used as a source of capital to use, in the 'national interest', to fund the Labor Government's policies and ideological programs. This is tantamount to nationalising those superannuation funds.
What does “suitable” really mean for a critical worker under section 9A of the Enhanced CIRMP Rules 2026? In this episode, Marina Shteinberg and Tim Slattery explore who makes the suitability decision, who owns the risk, and how ongoing assurance should work in practice. We examine the three pathways to critical component access — AusCheck plus the responsible entity’s suitability assessment, a relevant NV1+ security clearance, and the CIRMP risk-managed pathway — and explain what each pathway establishes, who makes the key decisions, and what responsibility remains with the organisation. We also look at ongoing suitability, the relationship with insider threat capability, and practical implementation outcomes for organisations preparing for the enhanced personnel security requirements under section 9A.
Oztopia: Academia explores the behaviour of some Australian academics and higher learning institutions who choose to collaborate with academia hostile states including China, Russia and Iran.
In this episode, Tim Slattery and Marina Shteinberg, Co-Founders and Directors of Pentagram Advisory, unpack the personnel security implications of section 9A of the Enhanced CIRMP Rules 2026 and what responsible entities should prioritise ahead of the 10 June 2027 and 10 June 2028 implementation milestones. They explore how section 9A strengthens expectations around access management, critical worker identification and suitability, ongoing personnel assurance and workforce lifecycle security. The discussion also looks at why implementation should begin with risk, how to think about the two layers of access — to the critical infrastructure asset and to critical components — and why organisations need to connect people, roles, access, suitability and assurance within a coherent enterprise personnel security architecture. The episode concludes with a broader question of trust: how organisations can build appropriate assurance around the trust they grant to employees, contractors and third parties with access to their most critical assets, systems and information — their organisational “crown jewels”.
How much of what we judge to be a material security risk is driven by evidence — and how much by what we can most easily remember? In this episode, Tim Slattery and Marina Shteinberg of Pentagram Advisory explore the availability heuristic and what behavioural science can teach us about security risk management and decision making under uncertainty. In an era of heightened uncertainty, Boards, executives and security leaders are required to make consequential decisions with information that may be incomplete, uneven or constantly changing. Recent incidents, personal experience and highly visible threats can quickly dominate attention — while less familiar but potentially material risks remain outside the spotlight. Tim and Marina examine how availability bias can influence security risk assessment, risk prioritisation and investment decisions, and why a formal risk management framework does not remove human judgement — it structures where that judgement is exercised. They also consider practical ways to strengthen decision-making through broader evidence, structured challenge and greater transparency around the reasoning behind risk ratings. Because what is memorable is not necessarily what is material. And unfamiliarity is not evidence of safety.