Trust, bias and the challenge of managing human risk in critical infrastructure.
Introduction
Most Boards and executive teams are now accustomed to discussing cyber security, supply chain disruption, regulatory compliance and operational resilience. These risks are longstanding and hence familiar. They appear on risk registers, in audit reports, in regulatory briefings and in executive dashboards. They are discussed as matters of governance, investment and accountability.
Yet one risk often remains more elusive, more difficult to name, prioritise and resource: the risk that harm to the organisation could be caused by someone who already has authorised access, organisational knowledge and a degree of trust.
This is the uncomfortable space of insider threat and insider risk. This is not uncomfortable because senior leaders deny that insider events occur. Most know they do. Leaders have seen the media reports, heard the case studies, and understood the potential consequences and cost of insider threat behaviour: unauthorised disclosure, sabotage, fraud, process corruption, data theft, or misuse of privileged access. The difficulty is more subtle. Many leaders struggle to believe that such an event could emerge from within their own organisation, from their own workforce, or from people they know, trust and rely upon.
This is the “Not In My Organisation” mindset. It is rarely expressed as openly as that. More often, it appears in softer forms through platitudes including: “We have a good culture.” “We trust our people.” “Our HR processes would pick that up.” “We already do background checks.” “Our cyber controls are strong.” “That kind of behaviour does not fit who we are.” Each of these statements may contain some truth. But together, they can create a powerful leadership blind spot.
Research by the UK National Protective Security Authority (NPSA) has highlighted this gap between the theoretical recognition of insider risk and the willingness to treat it as a practical, organisation-specific risk. In one study, only 20 per cent of leaders viewed insiders as a threat to their own organisation. Many saw insider risk as important in principle, yet difficult to prioritise in practice. Insider events can appear remote, improbable or disconnected from the organisation’s everyday operations. They may be viewed as isolated incidents rather than as part of a broader human risk picture. Most significantly, leaders can feel uncomfortable with the idea that “their people” could intentionally act against the organisation.
That discomfort matters. Senior executives are trained to make decisions under uncertainty. They routinely assess financial, operational, legal, cyber and strategic risks. Yet insider threat sits in a different psychological category because it touches relationships, identity, judgement, leadership and trust. To acknowledge insider risk is not simply to accept that a control may fail. It can feel like accepting that people the organisation has recruited, promoted, mentored or trusted may behave in ways that cause harm. For some leaders, this feels less like risk management and more like mistrust.
That is why insider threat complacency cannot be addressed by statistics alone. Evidence is important, but facts do not always shift perception when the barrier is psychological. The more important question is not only, “What is the insider threat?” but “Why do capable, experienced leaders underestimate it?”
This article explores that question. It considers the psychology behind the “Not In My Organisation” mindset, including optimism bias, availability bias, the trust heuristic, identity protection, assumptions about the psychological contract, the false divide between trust and verification, and overconfidence in existing controls. These drivers are not signs of poor leadership. They are recognisably human ways of thinking. But when left unexamined, they can prevent organisations from investing in the very programs that protect their people, assets, operations and reputation.
The article also examines the language of trust. When a leader says, “We trust our people,” what does that really mean? At one level, the sentence is simple. At another, the meaning is complex. Trust between two people is not the same as trust between a person and an organisation. Interpersonal trust may be built on character, experience and relationships. Organisational trust must also be supported by governance, assurance, accountability, transparency and proportionate, risk-based assurance measures.
This distinction is critical. Effective insider threat and trusted workforce programs are not built on suspicion. They are built on a mature understanding that people, circumstances and risks change over time. They recognise that employees can be both a source of strength and, at times, a source of vulnerability. They support people while also protecting the organisation. They balance trust with assurance.
For critical infrastructure organisations, this balance is not optional. These organisations depend on people with access to sensitive information, critical systems, operational processes and essential services. The question is not whether leaders should trust their workforce. They must. The better question is whether that trust is supported by the structures, culture and governance needed to sustain it.
The organisations most resilient to insider threat are not those that trust less. They are those that understand trust more deeply. Like an iceberg, human risk is often defined less by what is visible above the surface than by what remains hidden beneath it.
The Leadership Perception Gap
If insider threat is a recognised security risk, why do so many organisations continue to underinvest in insider threat programs, trusted workforce initiatives and ongoing suitability measures?
Part of the answer lies in a gap between perception and preparedness.
Research conducted by the NPSA found that only 20 per cent of leaders viewed insiders as a threat to their own organisation. Many acknowledged that insider incidents occurred elsewhere, yet struggled to see the relevance of the threat to their own workforce, operations or assets. The same research found that 69 per cent of leaders did not believe their assets were at risk from insider activity, while 80 per cent did not view insiders as a threat to their organisation. These findings reveal a striking disconnect between the recognised existence of insider threat and its perceived applicability. The threat is understood in theory but often discounted in practice.
This disconnect appears to be reinforced by confidence in existing organisational controls. Many leaders believed that recruitment processes, background checking, workplace culture, management oversight, cyber security measures or existing human resources practices would identify or prevent insider incidents before they could occur.
The challenge is not that these controls lack value. Rather, it is that insider risk is rarely the result of a single failed control. Insider incidents often emerge through a combination of circumstances, vulnerabilities, behavioural changes, personal stressors, organisational issues and opportunities that develop over time. These can occur within a person’s work life, their private life, or be imposed on them by an external driver such as social or economic events. A police check completed several years ago, a strong organisational culture or a well-written policy may contribute to risk reduction, but none of these measures alone eliminate human risk.
Empirical research into real-world insider incidents presents an even more challenging picture. Dr Michael Robinson’s analysis of hundreds of insider threat cases found that insider incidents occur across industries, organisation types and workforce categories. Importantly, the research challenges another common assumption: insider threats are not confined to junior employees, contractors or individuals already perceived as problematic. In Robinson’s dataset, approximately 26 per cent of insiders occupied senior management or executive positions.
This finding deserves careful consideration. Senior executives are often viewed as decision-makers responsible for managing insider risk. Yet they are also insiders themselves. They possess privileged access, organisational influence, sensitive information and decision-making authority. The factors that contribute to insider risk—financial pressure, personal grievances, external influence, stress, overconfidence, ethical lapses or changing personal circumstances—do not disappear with seniority. In some cases, the consequences of poor decisions may increase as authority increases.
Taken together, the NPSA and Robinson findings point towards an uncomfortable conclusion. Insider threat is not primarily a problem that affects “other organisations” or “other people”. It is a human risk that exists wherever people are trusted with access, authority, information or responsibility.
The question, therefore, is not whether insider threat exists. The evidence leaves little room for doubt. The more interesting question is why capable, intelligent and experienced leaders continue to underestimate its relevance to their own organisations.
To answer that question, we need to look beyond security controls and risk registers and examine the psychology that shapes how leaders perceive risk, trust and human behaviour.
What Do We Mean When We Say “Trust”?
A significant part of the insider threat conversation turns on one deceptively simple word: trust.
When leaders say, “We trust our people,” the statement is easy to understand at a surface level. It is a phrase frequently heard in Boardrooms, executive meetings and discussions about organisational culture. It reflects confidence in the workforce and a belief that employees will act in the organisation’s best interests. Few leaders would argue against the importance of trust. Indeed, organisations cannot function effectively without it.
Yet the meaning of trust is not always as straightforward as it first appears.
Linguists often distinguish between semantics and pragmatics in language. Semantics concerns the meaning of a word itself, while pragmatics considers how context influences meaning and intent.
Semantically, the Oxford Dictionary defines trust as “the belief that somebody or something is good, sincere, honest, etc. and will not try to harm or trick you.” It is a definition grounded in relationships, character and intent. Viewed through this lens, trust is fundamentally positive. It reflects confidence in another person’s integrity and reliability.
Pragmatically, however, the meaning of trust depends on context. When a leader says, “We trust our people,” they may be expressing confidence in the character, loyalty and values of their workforce. They may be offering trust in the hope of gaining reciprocal trust from their team. When a security, risk or legal professional uses the same word, they may be thinking about assurance, accountability, governance and the need to verify that people entrusted with critical responsibilities remain suitable for their role over time.
Both perspectives are valid, but they are not necessarily referring to the same thing. Understanding this distinction is important because discussions about insider threat often become difficult not because people disagree, but because they are using the same word to mean different things.
Trust between two people is not identical to trust between a person and an organisation. Interpersonal trust is often built through experience, familiarity, reputation and perceived character. Organisational trust must be broader. It requires systems that are fair, transparent, proportionate and consistently applied. It requires clarity about expectations, accountability for conduct, appropriate safeguards around access, and mechanisms to identify when people may need support or when risk is changing.
A trusted workforce is therefore not a workforce that is never assessed, never questioned and never subject to ongoing assurance. Rather, it is a workforce where trust is actively and continuously maintained through good leadership, clear communication, fair processes and proportionate protective measures.
This distinction is particularly important in the context of insider threat. Insider threat programs can sometimes be misunderstood as a sign that an organisation does not trust its people. In reality, mature insider threat and trusted workforce programs should achieve the opposite. They should strengthen trust by creating transparency, consistency and fairness, while also protecting critical assets, operations and people from avoidable harm. Explaining how an organisation seeks to protect people through these two programs is essential to success.
The question for senior leaders is therefore not, “Do we trust our people?” The answer should be yes. The more important question is whether that trust is supported by the governance, culture and assurance measures necessary to manage the responsibilities, access and risks that come with operating critical infrastructure.
Before exploring the psychology behind the “Not In My Organisation” mindset, it is useful to examine a related distinction: the difference between trust that exists between individuals and trust that exists within organisations.
Trust Between People and Trust Within Organisations
The distinction between interpersonal trust and organisational trust is not merely academic. It has practical implications for how organisations manage risk.
Leaders build interpersonal trust through relationships, experience and observation. Over time they learn who is dependable, competent and aligned with organisational values. This form of trust is essential. Without it, delegation becomes difficult, collaboration slows and organisational performance suffers.
Organisations, however, carry responsibilities that extend beyond any individual relationship. Boards and executives are accountable not only for maintaining trust, but also for protecting critical assets, information, operations and services. They must strive to meet the legitimate needs and expectations of all stakeholders they are responsible to. As a result, organisations must complement interpersonal trust with governance mechanisms that provide assurance.
This is where many insider threat discussions become uncomfortable. Assurance measures can be perceived as signals of mistrust when viewed through an interpersonal lens. Yet from an organisational perspective, they serve a different purpose. They help ensure consistency, fairness and resilience across the enterprise.
Workforce screening, ongoing suitability assessments, segregation of duties, audits and access controls are not expressions of distrust. They are governance mechanisms designed to manage risk in a structured and proportionate manner.
The distinction is important because trust and assurance perform different functions. Trust enables collaboration, empowerment and discretionary effort. Assurance provides confidence that critical risks remain within acceptable boundaries. One is primarily relational; the other is primarily organisational.
High-performing organisations require both.
The aviation industry offers a useful example. Airlines trust their pilots, yet still require recurrent training, medical assessments, supervision and independent review processes. These measures do not exist because trust is absent. They exist because trust alone is insufficient to manage complex risks.
The same principle applies to critical infrastructure. Organisations trust their people while simultaneously implementing assurance measures that protect operations, assets and employees themselves. The objective is not to replace trust with controls. It is to create an environment where trust can be sustained responsibly over time.
Understanding this distinction helps explain why discussions about insider threat often generate resistance. The resistance is rarely about the controls themselves. More often, it reflects deeply held beliefs about trust, leadership and human behaviour.
The Seven Psychological Drivers of the “Not In My Organisation” Mindset
If insider threat is a recognised risk, and if trust and assurance are complementary rather than competing concepts, why do so many organisations continue to underinvest in insider threat mitigation and trusted workforce programs?
Part of the answer lies in psychology.
Human beings do not assess risk purely through logic or evidence. We rely on mental shortcuts, personal experiences, assumptions, mental models and deeply held beliefs that help us make sense of a complex world. These mechanisms are not inherently flawed. In many situations they help us make decisions quickly and effectively. However, they can also create blind spots that influence how leaders perceive insider risk.
1. Optimism Bias: “It Won’t Happen Here”
Optimism bias is the tendency to believe that negative events are more likely to happen to others than to ourselves. Most people recognise that accidents, fraud, cyber incidents and security breaches occur. At the same time, they often assume their own organisation is less likely to experience them.
For leaders, optimism bias may manifest as a belief that insider incidents are possible in principle but unlikely in practice. The organisation may be viewed as having a stronger culture, better people or more effective controls than its peers.
The challenge is that insider incidents rarely announce themselves in advance. By the time evidence becomes obvious, significant harm may already have occurred. Effective risk management requires organisations to prepare for risks before they become visible.
2. Availability Bias: “We Have Never Experienced It”
People often judge the likelihood of an event based on how easily examples come to mind. If a leader has never personally experienced an insider incident, the threat may feel distant or improbable.
The NPSA found that leaders who had previously experienced insider events were significantly more likely to recognise insider threat as a genuine organisational risk. Personal experience made the threat more tangible and therefore more difficult to dismiss.
The absence of a known insider incident should not be interpreted as evidence that the risk does not exist. In many cases, insider incidents remain undetected, unreported or are attributed to other causes. Organisations should be careful not to mistake a lack of visibility for a lack of risk.
3. The Trust Heuristic: “I Know These People”
Trust is often built through experience. Leaders work closely with their teams, observe their performance and develop confidence in their judgement and integrity.
This generally serves organisations well. However, familiarity can sometimes become a substitute for objective assessment.
When leaders know and trust an individual, they may unconsciously discount warning signs or assume that established relationships reduce the likelihood of harmful behaviour. Yet many insider incidents involve individuals who were previously regarded as trusted, reliable and high performing.
The lesson is not to trust less. It is to recognise that trust should be supported by appropriate assurance mechanisms, particularly where individuals hold positions of significant responsibility or access.
4. Identity Protection: “This Does Not Reflect Who We Are”
For many leaders, acknowledging insider risk can feel personally uncomfortable because it challenges deeply held beliefs about the organisation and their role within it.
A strong organisational culture is often viewed as a source of pride. Leaders invest significant effort in building teams, shaping values and creating positive workplace environments. The suggestion that an insider incident could occur may feel inconsistent with that identity.
In some cases, insider threat is subconsciously rejected not because the evidence is weak, but because accepting it creates psychological discomfort. It may raise questions about culture, leadership effectiveness or the ability to judge character.
Yet recognising insider risk does not imply a failed culture. It simply acknowledges that all organisations are composed of human beings, and human behaviour is inherently complex.
5. The Psychological Contract Assumption: “If We Treat People Well, They Will Do the Right Thing”
Most organisations strive to create positive workplace environments. They invest in culture, leadership development, employee engagement and wellbeing initiatives. These efforts are important and often produce significant benefits.
However, leaders can sometimes assume that positive treatment alone is sufficient to prevent insider risk.
As discussed in our previous article on the psychological contract, employees develop expectations about what they believe the organisation owes them and what they owe the organisation in return. When these expectations are met, trust and commitment often grow stronger. When they are perceived to be broken, attitudes and behaviours may change.
Importantly, people do not remain static. Personal circumstances evolve. Financial pressures emerge. Relationships change. Stress accumulates. Perceived grievances develop. An individual who was highly engaged at one point in time may face very different circumstances later.
Strong culture and positive leadership remain essential. However, they should be viewed as risk-reducing factors rather than guarantees.
6. The Trust-versus-Mistrust Fallacy: “Either We Trust People or We Monitor Them”
One of the most persistent misconceptions in insider threat management is the belief that organisations must choose between trust and oversight.
Under this view, implementing screening, monitoring or assurance measures implies that employees are not trusted. As a result, some leaders hesitate to introduce controls out of concern that they will damage culture or morale.
This is a false choice.
High-performing organisations routinely combine trust with assurance. They trust employees while also implementing governance, oversight and accountability mechanisms appropriate to the risks involved. The objective is not to create a culture of suspicion but to create a culture of resilience.
Trust and assurance are not opposing forces. They are complementary elements of responsible organisational leadership.
7. Overconfidence in Existing Controls: “We Already Have Processes for That”
The final driver is overconfidence in existing systems and controls.
Many organisations already conduct background checks, maintain policies, implement cyber security measures and provide management oversight. These are all valuable safeguards.
However, the NPSA found that many leaders placed considerable confidence in existing people and systems to identify or prevent insider incidents. Confidence in controls can sometimes create the impression that the problem has already been solved.
The reality is that insider risk is dynamic. A control that was appropriate at the time of recruitment may not identify changes that occur years later. A cyber security tool may detect certain activities while missing behavioural indicators. Policies may exist without being consistently understood or applied.
The existence of controls should prompt organisations to ask whether those controls remain effective, proportionate and aligned to current risks.
Taken individually, each of these seven psychological drivers appears understandable.
Together, however, they can create a powerful tendency to underestimate insider risk within one’s own organisation. They help explain why capable and well-intentioned leaders may acknowledge insider threat in theory while struggling to see its relevance in practice.
Recognising these biases is not an admission of failure. It is the first step towards managing human risk more effectively and creating a workforce that is both trusted and resilient.
Moving Beyond the “Not In My Organisation” Mindset
Recognising the psychological drivers behind the “Not In My Organisation” mindset is an important first step. However, awareness alone does not reduce risk. The challenge for leaders is translating that awareness into practical action.
The objective is not to eliminate trust, create excessive oversight or introduce burdensome controls. Rather, it is to develop a more mature and balanced approach to managing human risk—one that recognises both the value people bring to an organisation and the vulnerabilities that can emerge as circumstances change.
The following five practical actions can help leaders move beyond insider threat complacency and build a more trusted, resilient and secure organisation.
1. Reframe Insider Threat as Human Risk
One of the most important shifts leaders can make is to stop viewing insider threat solely as a security issue.
Insider risk is fundamentally a human risk issue with potential security, operational, financial, legal and reputational consequences. It involves people, relationships, behaviour, decision-making and changing personal circumstances. Approaching insider risk exclusively through a security lens can lead organisations to focus on detection and enforcement while overlooking prevention, support and early intervention.
A human risk perspective encourages organisations to understand the conditions that influence behaviour and to identify vulnerabilities before they develop into significant problems.
2. Stop Viewing Trust and Assurance as Competing Concepts
Many organisations continue to treat trust and assurance as if they are mutually exclusive. As discussed earlier, this is a false choice.
Trust remains essential for high-performing organisations. However, trust is strengthened—not weakened—when supported by appropriate governance and assurance measures. These measures need to be explained to the people, to be transparent, to bolster trust in them and support for them.
The most resilient organisations do not choose between trust and verification. They recognise that both are necessary. Trust enables collaboration and performance. Assurance provides confidence that risks are being managed appropriately and consistently.
3. Treat Workforce Security as a Leadership Responsibility
Insider risk is often delegated to security, human resources or compliance teams. While each of these functions plays an important role, workforce security is ultimately a leadership issue.
The tone set by Boards, executives and senior managers shapes how organisations think about trust, accountability, reporting, employee wellbeing and risk management.
Leaders influence culture, priorities and investment decisions. As a result, they play a critical role in determining whether insider risk is recognised early or overlooked until a significant event occurs.
Managing human risk should therefore be viewed as a shared organisational responsibility rather than the sole responsibility of any single function.
4. Build Multidisciplinary Governance
Human behaviour does not fit neatly within organisational silos.
Many of the indicators associated with insider risk may be observed by different parts of the organisation. Human resources may identify workplace grievances or wellbeing concerns. Security teams may observe unusual behaviour or access patterns. Managers may notice changes in performance or engagement. Legal teams may become aware of conflicts of interest or policy breaches.
Effective insider risk management requires mechanisms that enable relevant information to be considered collectively and appropriately. Multidisciplinary governance structures involving security, human resources, legal, risk and operational functions can help organisations develop a more complete understanding of emerging risks while ensuring decisions remain proportionate, lawful and fair.
5. Invest in a Trusted, Risk-based and Proportionate Workforce Approach
Perhaps the most important action is to move beyond episodic checks and isolated controls towards a trusted, risk-based and proportionate workforce approach.
Such an approach recognises that suitability is not a point-in-time assessment. People change. Access and authority level change. Circumstances change. Threats and enterprise risks change.
Rather than focusing solely on identifying threats, mature programs seek to support employees, strengthen organisational trust, encourage reporting, identify emerging vulnerabilities and enable early intervention where appropriate. They combine proportionate assurance measures with employee support, clear communication, reporting, psychological safety and strong governance.
Ultimately, the goal is not to create a workforce that is monitored. It is to create a workforce that is trusted, supported and resilient. In doing so, organisations strengthen both workforce trust and security outcomes, creating benefits for employees, leaders and the organisation as a whole.
The organisations best positioned to manage insider risk are not those that assume trust is permanent. They are those that recognise trust must be actively maintained, supported and reinforced over time. They understand that trust and assurance are not competing concepts, but complementary elements of a resilient organisation.
Conclusion
Insider threat occupies a unique place in leadership thinking. Unlike cyber attacks, supply chain disruptions or other external threats, insider threat challenges assumptions about trust, culture, judgement and human behaviour. It asks leaders to confront an uncomfortable possibility: that risk can emerge not only from outside the organisation, but also from within it.
The evidence suggests that insider threat is not primarily a technology problem. Nor is it solely a security problem. It is fundamentally a human risk issue. Like all human risks, it is shaped by relationships, perceptions, circumstances and behaviour. It is also influenced by the assumptions leaders make about trust and the confidence they place in existing controls.
Recognising these realities does not require organisations to trust their people less. It requires them to understand trust more deeply. Trust and assurance are not opposing concepts. They are complementary elements of resilient organisations that seek to support their people while protecting their assets, operations and reputation.
The most resilient organisations are not those that assume insider threat could never happen to them. They are those that recognise human risk as an enduring reality and take practical, proportionate steps to manage it.
The question for leaders is therefore not whether they trust their people.
The question is whether they have moved beyond the belief that it could never happen in their organisation.