Observing the absence of usual and the presence of unusual
Introduction: The Illusion of Sudden Insider Risk
Insider incidents are often described as unexpected.
A data breach occurs. A policy is violated. Sensitive information is disclosed. The event appears sudden, and the question that follows is predictable: How did this happen?
However, in most cases, the incident itself is not the beginning of the problem. It is the point at which the problem becomes visible.
Across sectors, insider risk rarely materialises as a single, isolated act. It develops over time, shaped by a person’s changing circumstances, perceptions, and behaviour.
By the time a technical system detects anomalous activity, the behavioural trajectory that led to that moment has often been underway for weeks or months, even years.
This raises an important question for organisations responsible for protecting critical assets and operations: Are we looking in the right place for the earliest signals of risk?
Why Insider Incidents are Rarely Sudden
The idea that insider risk emerges suddenly is not supported by operational experience or empirical research.
Individuals rarely enter organisations with the intention to cause harm. Most join with the expectation of contributing, building a career, and acting in accordance with organisational values.
Over time, however, circumstances change.
Personal stressors may emerge. Professional pressures may increase. Perceptions of fairness may shift. Relationships may deteriorate. Organisational decisions may alter how individuals interpret their role and their connection to the organisation. In some cases the organisation’s conduct can lead to a perceived breach of the psychological contract — the unwritten expectations of fairness, recognition, and mutual obligation between the individual and the organisation.
These factors do not automatically create malicious intent within an individual, but they can influence the individual’s judgement, behaviour, and decision making.
How individuals interpret these circumstances, and how they choose to respond to them, plays a critical role in how risk develops over time.
Insider risk, therefore, is not a moment. It is a progression.
It develops through the interaction of:
- personal predispositions
- personal circumstances
- emerging stressors and behavioural indicators
- organisational responses, and
- access to systems, information, or authority.
This progression is consistent with established insider risk research, including Dr Eric Shaw’s Critical Pathway to Insider Risk, which demonstrates that insider incidents emerge through a sequence of interacting personal, behavioural and organisational factors over time.
The incident itself is simply the point at which that progression becomes visible in a way that can no longer be ignored.
Understanding Behaviour in Context: Enterprise, Role and Individual Risk
Behavioural change cannot be interpreted in isolation.
To understand whether a change is meaningful, it must be viewed through three interconnected risk lenses:
Enterprise risk — the threats and consequences relevant to the organisation’s operating environment.
Role risk — the level of access, authority, and potential impact associated with a specific position.
Individual behaviour — the person’s predispositions, circumstances, actions, and behavioural trajectory over time.
This structure is critical.
The same behaviour may carry very different implications depending on the role and its associated consequences. A change in behaviour in a low-risk role may be inconsequential. The same change in a high-consequence role may require immediate attention.
Without this context, organisations risk overreacting to benign behaviour or overlooking signals that are genuinely significant.
Behavioural Drift and Escalation
One of the most important, and often overlooked, mechanisms in this progression is behavioural drift.
Behavioural drift does not occur abruptly. It is gradual. It reflects the accumulation of small changes over time, rather than a single triggering event.
It may begin with subtle changes:
- reduced workplace engagement
- increased frustration
- minor deviations from expected behaviour.
Over time, these changes can evolve:
- rules may be interpreted more flexibly
- shortcuts may become normalised
- decisions may be rationalised under pressure.
These shifts often occur in the context of changing perceptions — particularly where individuals feel that expectations have not been met or fairness has been compromised.
In some cases, this reflects a perceived breach of the psychological contract, influencing how individuals interpret organisational decisions and justify their own responses.
Behavioural drift reflects not only changing circumstances, but how individuals interpret those circumstances and choose to respond.
Importantly, behavioural drift is not something that simply happens to an individual. It involves a series of internal decisions, sometimes conscious, sometimes less so, about how to respond to circumstances, pressures, and perceptions.
Different individuals respond differently to similar conditions. Some reflect, take responsibility, and adjust their behaviour constructively. Others may become more reactive, externalise responsibility, or adopt a perspective that emphasises grievance and perceived unfairness, reinforcing their justification for deviating from expected behaviour.
In many cases, individuals do not perceive themselves as acting improperly. They may justify themselves and believe they are:
- solving a problem
- compensating for organisational inefficiency
- responding to perceived unfairness, or
- simply doing what is necessary to meet expectations.
This is what makes behavioural drift particularly significant.
It is not always visible through formal controls. It is not always captured in policy breaches. And it rarely presents as a single, decisive moment.
Instead, it unfolds as a pattern — subtle, cumulative, and shaped by context.
The Signal: Absence of Usual, Presence of Unusual
If insider risk develops gradually, how does it first become observable?
Not through dramatic behaviour, but through change.
In practice, early signals of emerging risk are often identified through what can be described as the absence of usual behaviour, and the presence of unusual behaviour.
This may include:
- a previously reliable individual becoming inconsistent
- a collaborative team member becoming withdrawn
- a transparent communicator becoming guarded
- a stable performer showing signs of volatility
- a compliant employee beginning to challenge or bypass processes.
It may also present in more subtle ways, such as changes in routine, habits, or presentation, for example, noticeable shifts in working hours, reduced participation in team interactions, changes in communication style, or a decline in attention to detail or personal appearance.
Individually, these changes may appear minor. They may be explainable. They may not warrant concern in isolation.
But collectively, they may indicate that something has shifted.
Behavioural indicators become meaningful when interpreted through recognised personnel security risk domains, such as financial pressure, personal conduct, external influence, or emotional stress. These domains do not imply wrongdoing. Rather, they provide a structured way to understand how changing circumstances may influence judgement, vulnerability, or decision-making over time.
The critical point is this: The signal is not the behaviour itself. It is the change relative to what was previously observed.
Why Colleagues Notice First
Organisations often invest heavily in technical monitoring.
These systems are valuable. They can detect unusual access patterns, abnormal data movement, negative sentiment, deviations in system usage.
However, technical systems analyse activity.
They do not interpret behaviour in context.
They cannot observe:
- tone of communication
- interpersonal dynamics
- emotional state
- changes in judgement, or
- subtle shifts in workplace behaviour.
From a psychological perspective, humans are highly attuned to changes in behaviour within their social environment. Through everyday interaction, people develop an implicit understanding of what is “normal” for those around them — how they communicate, behave, and respond under typical conditions. When that baseline shifts, even subtly, it can register as a sense that something is different, often before it can be clearly articulated.
As a result, those closest to the individual, colleagues, supervisors, team members, are often the first to notice that something has changed.
In many insider incidents, the signals were present. They were observed. But they were not recognised as relevant, not reported, or not acted upon in time.
This highlights a critical reality: The earliest warning system in any organisation is not technology. It is people.
Case Study: Cleared, Trusted — and Changing
Consider the following scenario.
An engineer in a critical role within a critical infrastructure organisation holds privileged access to operational systems.
The individual successfully completed pre-employment screening, including an AusCheck background check. At the time of recruitment, no concerns were identified.
Performance was strong. Trust was established.
For several years, the individual was regarded as dependable, collaborative, and technically capable.
Every time an organisation grants access of this kind, it is making a trust decision — a judgement that the level of residual risk associated with that role is acceptable at that point in time.
Over time, however, circumstances began to change.
A new manager was appointed, introducing a more directive and closely controlled management style. The working relationship lacked rapport, and the engineer perceived a reduction in autonomy and trust. Informal communication declined, and psychological safety within the team began to erode.
Around the same period, the engineer was unsuccessful in securing an internal promotion they had expected. This contributed to a growing sense of frustration and perceived unfairness.
Outside of work, additional pressures emerged. The engineer began experiencing financial strain linked to personal circumstances. A close family member developed ongoing health issues, requiring time, attention, and emotional energy. At home, there were increasing challenges managing difficult teenage children.
These pressures did not immediately result in concerning behaviour. However, they began to influence how the engineer interpreted workplace events and decisions.
Initially, the changes appeared minor:
- increased frustration with management decisions
- more critical commentary in team discussions
- occasional withdrawal from collaborative work.
Over time, patterns began to form.
The engineer became more disengaged from the team and less willing to seek input from others. Communication became more guarded. There was a growing tendency to question organisational decisions and processes, often framing them as inefficient or unfair.
At the same time, subtle behavioural shifts emerged:
- irregular working hours began to increase
- system access occurred outside normal operational schedules
- communication with colleagues became more limited.
There were also changes in personal habits, including signs of fatigue and reduced attention to detail. The engineer increasingly relied on alcohol as a coping mechanism for stress, further affecting judgement and consistency.
Individually, none of these indicators appeared sufficient to trigger concern.
But collectively, they reflected a shift. Many of these changes were observable to those around the engineer, but were not initially recognised as indicators of increasing risk.
Over time, this shift progressed:
- organisational dissatisfaction became more visible
- policy boundaries were tested and occasionally bypassed
- decisions were increasingly justified based on perceived necessity rather than established process.
Importantly, there was no single moment at which the engineer “became a risk”.
The risk developed through the interaction of changing circumstances, evolving perceptions, and a series of decisions about how to respond.
The purpose of recognising these signals is not to assign blame, but to determine whether the original trust decision should be revisited through a structured and proportionate reassessment of suitability.
Why Technical Monitoring Detects Late
In the scenario above, many of the early indicators were behavioural rather than technical.
Changes in communication, engagement, and judgement were visible to those working closely with the engineer. However, these changes did not immediately translate into system-level anomalies.
Technical monitoring plays an important role in modern security environments. It provides visibility into system activity and can identify anomalies that may indicate misuse, compromise, or policy violations. It also provides a record, a recallable history of events.
However, technical monitoring has inherent limitations.
It:
- detects activity as it occurs and notifies after activity occurs
- identifies deviations from expected patterns
- cannot determine intent
- cannot interpret human context.
In many cases, technical alerts are triggered only once behaviour has already escalated into observable system activity, such as irregular access patterns or policy violations.
Over-reliance on technical monitoring therefore creates a structural delay in detection and therefore in reaction.
By contrast, behavioural indicators often emerge earlier.
They provide insight not into what has happened, but into what may be developing.
This distinction is critical: technology detects events, behaviour reveals trajectories.
How Organisations Should Respond — Without Overreaction
Recognising behavioural change is only the first step.
How organisations respond is equally important.
A common risk is overreaction — treating indicators as evidence of wrongdoing rather than signals requiring understanding.
This approach is counterproductive. It discourages reporting, creates fear, and undermines trust.
Mature organisations take a more structured and proportionate approach.
1. Indicators are not accusations
Behavioural indicators are not proof of intent. They are signals that circumstances, perceptions, or behaviour may have changed — and that further understanding is required.
2. Focus on patterns, not isolated events
Single behaviours are rarely meaningful in isolation. Patterns over time provide context, particularly when considered alongside the individual’s role, access, and the potential consequences associated with that role.
3. Understand interpretation, not just behaviour
Behavioural change reflects not only circumstances, but how individuals interpret those circumstances and choose to respond.
Effective response requires understanding:
- how the individual perceives their situation
- whether they are reflecting and taking responsibility, or externalising responsibility, and
- how this may be influencing their decisions and behaviour.
4. Respond proportionately and early
Early response should prioritise conversation, clarification, and support.
The objective is to understand and, where possible, stabilise the situation before behaviours escalate.
At this stage, the focus should be on support and wellbeing — not punishment. In many cases, early intervention can address underlying stressors, reduce risk, and prevent further behavioural drift.
Escalation should occur only where patterns strengthen or risk increases.
5. Reassess trust in context
Where patterns of concern emerge, organisations should consider whether the original trust decision remains appropriate.
This includes reassessing the individual’s current circumstances and behaviour, the level of access associated with their role, and the potential impact of that access in the current context.
6. Apply structured, multidisciplinary judgement
Effective responses draw on:
- Security
- human resources
- risk management
- legal and governance functions.
The objective is not informal or reactive judgement, but a structured, fair, and defensible reassessment where required.
Strategic Implications: A Shift in How We See Risk
This perspective has important implications for organisations — particularly at the leadership level.
Managing insider risk is not simply a technical challenge. It is a human and organisational one.
It requires a shift:
- from detection to early visibility
- from isolated events to behavioural patterns
- from system monitoring to workforce awareness
- from reactive response to proactive understanding.
This shift requires a more human-centric approach to risk.
Organisations must build the capability to understand and work with people — not just monitor systems. This includes equipping supervisors and managers with the skills to recognise behavioural change, engage in constructive conversations, and respond appropriately.
It requires:
- strong communication and interpersonal capability
- the ability to cooperate across functions, and
- a high level of emotional intelligence in leadership and management roles.
These are not optional “soft skills”. They are core capabilities for managing human risk.
At the same time, organisations must create environments that support agency, responsibility, and accountability. This includes fostering trust, enabling appropriate autonomy, and reinforcing intrinsic motivation — so that individuals are more likely to respond constructively to pressure, rather than drift in ways that increase risk.
This is not just an operational adjustment — it is a leadership responsibility.
Organisations that rely solely on technical controls will always detect risk later in its progression, when options for intervention are limited.
Those that integrate behavioural awareness into their workforce assurance approach — supported by clear governance, trusted reporting pathways, proportionate response, and a strong organisational culture that enables psychological safety and early reporting — gain the ability to identify risk earlier, when it is still manageable.
Conclusion: Seeing What Develops Before It Becomes Visible
Insider risk is rarely hidden. More often, it is unrecognised.
The earliest signals are present in the workplace:
- in behaviour
- in interaction
- in subtle change.
They appear before system alerts. They appear before incidents. They appear in ways that are easy to overlook.
The challenge for organisations is not simply to detect events.
It is to recognise change in context — and to understand what that change means.
This requires organisations to look beyond systems and indicators, and to develop the capability to interpret behaviour, respond proportionately, and act early.
Because in the context of insider risk, the most important question is not: What happened?
It is: What changed — and when did we first have the opportunity to see it?
