Criminal Background Checks

A subject may be motivated by personal, financial, or professional interests that directly conflict with their duties and obligations to the organization. This inherent conflict of interest can lead the subject to engage in actions that compromise the organization’s values, objectives, or legal standing.

For instance, a subject who serves as a senior procurement officer at a company may have a financial stake in a vendor company that is bidding for a contract. Despite knowing that the vendor's offer is subpar or overpriced, the subject might influence the decision-making process to favor that vendor, as it directly benefits their personal financial interests. This conflict of interest could lead to awarding the contract in a way that harms the organization, such as incurring higher costs, receiving lower-quality goods or services, or violating anti-corruption regulations.

The presence of a conflict of interest can create a situation where the subject makes decisions that intentionally or unintentionally harm the organization, such as promoting anti-competitive actions, distorting market outcomes, or violating regulatory frameworks. While the subject’s actions may be hidden behind professional duties, the conflict itself acts as the driving force behind unethical or illegal behavior. These infringements can have far-reaching consequences, including legal ramifications, financial penalties, and damage to the organization’s reputation.

A subject is motivated to advance the intelligence, political, economic, military, or other strategic objectives of a nation-state through unauthorized activities within an organization. These activities may include obtaining sensitive information, facilitating covert access, manipulating organizational systems or decisions, degrading operational capabilities, or establishing persistent access for future exploitation.

The subject may act on behalf of a foreign government or intelligence service, or independently in support of perceived nation-state interests. Their involvement may arise through recruitment, pre-existing affiliations, ideological alignment, or other relationships that influence their actions.

During an investigation, espionage as a motive should be supported by evidence connecting the subject's activities to identifiable nation-state objectives. The subject's nationality, background, or foreign associations alone do not establish an espionage motive.

A subject is motivated by political, philosophical, religious, social, or other ideological beliefs to engage in an infringement against an organization. Such infringements may include unauthorized access, data exfiltration, destruction of information, sabotage, or violations of organizational policy undertaken to advance, defend, or draw attention to a particular cause or belief system.

Ideological motivation arises when a subject's beliefs influence their decision to act against the interests or established rules of an organization. The subject may perceive their actions as morally justified, necessary, or consistent with a broader political, philosophical, or social objective, even where those actions result in organizational harm.

During an investigation, ideological motivation should be established through evidence linking the subject's expressed objectives or beliefs to the infringement. The possession or expression of ideological beliefs alone does not establish malicious intent or constitute evidence of an insider threat.

A subject is motivated to undertake an infringement as a result of a materially incorrect understanding of circumstances, events, or perceived threats. The subject's actions are based on factual assumptions that are demonstrably false or inconsistent with established evidence, rather than an accurate understanding of the situation.

This may include a subject who incorrectly believes organizational systems have been compromised, that colleagues are acting against them, or that particular information or assets present a threat requiring intervention. Acting on these misconceptions, the subject may undertake actions they believe are necessary or justified, despite the absence of the circumstances they perceive.

During an investigation, the subject's understanding of events should be assessed against corroborating evidence. Investigators should establish whether a material factual misconception influenced the infringement and avoid inferring a psychiatric condition solely from the subject's statements or behavior.

Resentment is a sustained internal feeling of injustice, bitterness, or perceived mistreatment that may develop over time within a subject. While not always leading to overt action, resentment alters the subject’s psychological orientation toward the organization or its members, potentially lowering thresholds for future misconduct.

Resentment often originates from subjective perceptions of unfairness—such as feeling overlooked, underappreciated, marginalized, or treated unequally. It may be directed at individuals (e.g., managers, peers) or the organization itself. Unlike motives that are reactive or sudden, resentment is typically a chronic state that develops quietly and may go undetected in traditional monitoring systems.

Resentment should be viewed as a risk amplifier rather than an immediate driver of malicious action. It often lays the psychological groundwork for escalation into more active motives, including retaliation or sabotage. Intervention strategies may be more effective during this stage than after escalation.

A subject, driven by excessive pride in their nation, country, or region, undertakes actions that harm an organization. These actions are self-initiated and conducted unilaterally, without instruction or influence from legitimate authorities within their nation, country, region, or any other third party. The subject often perceives their actions as acts of loyalty or as benefiting their homeland.

While the subject may believe they are acting in their nation’s best interest, their actions frequently lack strategic foresight and can result in significant damage to the organization.

A subject, motivated solely by personal curiosity, may take actions that unintentionally cause or risk harm to an organization. For example, they might install unauthorized software to experiment with its features or explore a network-attached storage (NAS) device without proper authorization.

A subject deliberately takes or appropriates physical assets belonging to an organization without authorization. This may include corporate laptops, mobile phones, storage devices, IT equipment, physical documents, or other organizational property.

Theft may result in financial loss, operational disruption, or the unauthorized possession of sensitive organizational information. Where stolen assets contain or provide access to organizational data, the infringement may also create opportunities for subsequent unauthorized access, data disclosure, or exfiltration.

The subject deliberately pushes or tests organizational policies, rules, or controls to assess tolerance levels, detect oversight gaps, or gain a sense of impunity. While initial actions may appear minor or exploratory, boundary testing serves as a psychological and operational precursor to more serious misconduct.

Characteristics

• Motivated by curiosity, challenge-seeking, or early-stage dissatisfaction.
• Actions often start small: minor policy violations, unauthorized accesses, or circumvention of procedures.
• Rationalizations include beliefs that policies are overly rigid, outdated, or unfair.
• Boundary testing behavior may escalate if it is unchallenged, normalized, or inadvertently rewarded.
• Subjects often seek to gauge the likelihood and severity of consequences before considering larger or riskier actions.
• Testing may be isolated or gradually evolve into opportunism, retaliation, or deliberate harm.

Example Scenario

A subject repeatedly circumvents minor IT security controls (e.g., bypassing content filters, using personal devices against policy) without immediate consequences. Encouraged by the lack of enforcement, the subject later undertakes unauthorized data transfers, rationalizing the behavior based on perceived inefficiencies and low risk of detection.

The subject deliberately adopts or fabricates an identity—visually, digitally, or procedurally—to gain access, mislead stakeholders, or enable a planned insider event. Impersonation may occur in physical environments (e.g., unauthorized use of uniforms or cloned ID cards), digital platforms (e.g., email aliases or collaboration tools), or human interactions (e.g., job interviews). These behaviors typically precede unauthorized access, credential misuse, sabotage, or data exfiltration, and may allow subjects to operate without attribution or delay detection.

Impersonation is a high-risk preparatory behavior that often precedes direct misuse of trust. By assuming a false identity or misrepresenting role, authority, or affiliation, the subject gains unauthorized access or influence—without triggering traditional insider threat controls.

An organization entrusts a Managed Service Provider (MSP) with administrative or operational access to its digital environment - typically for IT support, system maintenance, or development functions. This access is often persistent, privileged, and spans sensitive infrastructure or data environments.

The means is established when MSP personnel, including potential subjects, are permitted to authenticate into the client’s environment from systems or networks entirely outside the client's visibility or jurisdiction. These MSP endpoints may be unmanaged, unmonitored, or physically located in regions where customer organization's policies, incident response authority, or legal recourse do not apply.

This creates an unobservable access channel: the subject operates from infrastructure beyond the reach of the customer organization's logging, endpoint detection, or identity correlation. The organization is therefore unable to monitor or verify who accessed what, when, or from where—rendering all downstream actions unauditable by the customer organization's internal security teams, unless mirrored within the client-controlled environment.

The exposure can be compounded by the MSP’s internal controls (or lack thereof). Weak credential custody practices, shared administrative accounts, inadequate background checks, or poor workforce segmentation create conditions where privileged misuse or unauthorized access can occur without attribution or immediate detection. The subject does not require escalation—they begin with sanctioned access and operate under delegated trust, often without the constraints applied to internal staff.

This structural dependency - privileged access held externally, without enforceable oversight - creates the necessary conditions for an insider infringement to occur with low risk of interruption or accountability.

The subject transitions internally within the organization (changing teams, departments, or roles) with the pre-formed intent to gain access to sensitive data, circumvent existing controls, or otherwise contravene internal policies. Unlike ordinary internal mobility driven by career growth or business need, mover-motivated behavior reflects an intentional exploitation of trust, structural opacity, or access privileges.

These subjects may actively seek out roles with higher entitlements, reduced scrutiny, or privileged visibility, such as administrative, developer, or compliance-adjacent positions. In some cases, the move may be strategic, occurring only after access restrictions or audit trails were encountered in a prior role. The behavior is often concealed within legitimate transfer processes and is rarely flagged by automated systems due to its formal procedural alignment.

Risk is elevated when access control systems do not enforce least privilege during role transitions, resulting in entitlement accumulation or residual access across multiple roles. This enables subjects to retain legacy access while acquiring new privileges in the destination team. Such conditions create a lateral movement surface that mirrors adversarial posturing seen in external threat models but is internally sanctioned.

Investigators should be alert to post-transfer behavior that reflects opportunistic access, unaligned with new role expectations, or targeting historically restricted systems. Mover-motivated actions often signal prior drift, dissatisfaction, or premeditated positioning, and should trigger retrospective analysis of behavioral trajectory and entitlement changes.

The subject enters the organization with a pre-formed intent to exploit their position, gain access to sensitive data, or otherwise contravene internal policies. Unlike most new hires (who align with organizational values and security expectations) joiner-motivated subjects present a latent threat from day one, often embedding their intent within the onboarding process, role selection, or early-stage access decisions.

Joiner motivation may stem from pre-existing agendas including espionage, competitive intelligence, ideology, or personal financial gain. The subject may deliberately target roles that offer visibility into proprietary systems, customer data, intellectual property, or internal governance. Their background may be curated to pass pre-employment screening, and they may arrive with pre-established exfiltration methods or operational security tactics designed to avoid detection.

Risk is highest during the early tenure period, when access is granted but behavioral baselines are not yet established. These subjects often exploit onboarding leniency, trust-building phases, and provisioning delays, taking advantage of initial low scrutiny to stage preparatory actions or initiate incremental infringement.

Investigators should treat joiner cases with heightened sensitivity. Detection may implicate upstream controls such as hiring processes, third-party screening providers, or internal referral pathways. Missteps in attribution may also generate legal or reputational risk, particularly if the subject was placed in a position of elevated trust.

A subject actively seeks opportunities to participate in an infringement on behalf of an external party by advertising, offering, or communicating their willingness to misuse organizational access, information, or position of trust. This may involve posting on underground forums, responding to recruitment advertisements, or approaching individuals through social media, messaging platforms, or other communication channels.

The subject may disclose their employment position, access privileges, or potential capabilities to attract interested parties, negotiate compensation, or establish arrangements for subsequent unauthorized activity.

A subject with access to payment environments or transactional data may deliberately or inadvertently leak sensitive payment card information. Payment Card Data Leakage refers to the unauthorized exposure, transmission, or exfiltration of data governed by the Payment Card Industry Data Security Standard (PCI DSS). This includes both Cardholder Data (CHD)—such as the Primary Account Number (PAN), cardholder name, expiration date, and service code—and Sensitive Authentication Data (SAD), which encompasses full track data, card verification values (e.g., CVV2, CVC2, CID), and PIN-related information.

Subjects with privileged, technical, or unsupervised access to point-of-sale systems, payment gateways, backend databases, or log repositories may mishandle or deliberately exfiltrate CHD or SAD. In some scenarios, insiders may exploit access to system-level data stores, intercept transactional payloads, or scrape logs that improperly store SAD in violation of PCI DSS mandates. This may include exporting payment data in plaintext, capturing full card data from logs, or replicating data to unmonitored environments for later retrieval.

Weak controls, such as the absence of data encryption, improper tokenization of PANs, misconfigured retention policies, or lack of field-level access restrictions, can facilitate misuse by insiders. In some cases, access may be shared or escalated informally, bypassing formal entitlement reviews or just-in-time provisioning protocols. These gaps in security can be manipulated by a subject seeking to leak or profit from payment card data.

Insiders may also use legitimate business tools—such as reporting platforms or data exports—to intentionally bypass obfuscation mechanisms or deliver raw payment data to unauthorized recipients. Additionally, compromised service accounts or insider-created backdoors can provide long-term persistence for continued exfiltration of sensitive data.

Data loss involving CHD or SAD often trigger mandatory breach disclosures, regulatory scrutiny, and severe financial penalties. They also pose reputational risks, particularly when data loss undermines consumer trust or payment processing agreements. In high-volume environments, even small-scale leaks can result in widespread exposure of customer data and fraud.

A subject misappropriates, discloses, or exploits proprietary information, trade secrets, creative works, or internally developed knowledge obtained through their role within the organization. This form of data loss typically involves the unauthorized transfer or use of intellectual assets—such as source code, engineering designs, research data, algorithms, product roadmaps, marketing strategies, or proprietary business processes—without the organization's consent.

Intellectual property theft can occur during employment or around the time of offboarding, and may involve methods such as unauthorized file transfers, use of personal storage devices, cloud synchronization, or improper sharing with third parties. The consequences can include competitive disadvantage, breach of contractual obligations, and significant legal and reputational harm.

PII (Personally Identifiable Information) leakage refers to the unauthorized disclosure, exposure, or mishandling of information that can be used to identify an individual, such as names, addresses, phone numbers, national identification numbers, financial data, or biometric records. In the context of insider threat, PII leakage may occur through negligence, misconfiguration, policy violations, or malicious intent.

Insiders may leak PII by sending unencrypted spreadsheets via email, exporting user records from customer databases, misusing access to HR systems, or storing sensitive personal data in unsecured locations (e.g., shared drives or cloud storage without proper access controls). In some cases, PII may be leaked unintentionally through logs, collaboration platforms, or default settings that fail to mask sensitive fields.

The consequences of PII leakage can be severe—impacting individuals through identity theft or financial fraud, and exposing organizations to legal penalties, reputational harm, and regulatory sanctions under frameworks such as GDPR, CCPA, or HIPAA.

Examples of Infringement:

• An employee downloads and shares a list of customer contact details without authorization.
• PII is inadvertently exposed in error logs or email footers shared externally.
• HR data containing employee National Insurance or Social Security numbers is copied to a personal cloud storage account.

PHI Leakage refers to the unauthorized, accidental, or malicious exposure, disclosure, or loss of Protected Health Information (PHI) by a healthcare provider, health plan, healthcare clearinghouse (collectively, "covered entities"), or their business associates. Under the Health Insurance Portability and Accountability Act (HIPAA) in the United States, PHI is defined as any information that pertains to an individual’s physical or mental health, healthcare services, or payment for those services that can be used to identify the individual. This includes medical records, treatment history, diagnosis, test results, and payment details.

HIPAA imposes strict regulations on how PHI must be handled, stored, and transmitted to ensure that individuals' health information remains confidential and secure. The Privacy Rule within HIPAA outlines standards for the protection of PHI, while the Security Rule mandates safeguards for electronic PHI (ePHI), including access controls, encryption, and audit controls. Any unauthorized access, improper sharing, or accidental exposure of PHI constitutes a breach under HIPAA, which can result in significant civil and criminal penalties, depending on the severity and nature of the violation.

In addition to HIPAA, other countries have established similar protections for PHI. For example, the General Data Protection Regulation (GDPR) in the European Union protects personal health data as part of its broader data protection laws. Similarly, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection, use, and disclosure of personal health information by private-sector organizations. Australia also has regulations under the Privacy Act 1988 and the Health Records Act 2001, which enforce stringent rules for the handling of health-related personal data.

This infringement occurs when an insider—whether maliciously or through negligence—exposes PHI in violation of privacy laws, organizational policies, or security protocols. Such breaches can involve unauthorized access to health records, improper sharing of medical information, or accidental exposure of sensitive health data. These breaches may result in severe legal, financial, and reputational consequences for the healthcare organization, including penalties, lawsuits, and loss of trust.

Examples of Infringement:

• A healthcare worker intentionally accesses a patient's medical records without authorization for personal reasons, such as to obtain information on a celebrity or acquaintance.
• An employee negligently sends patient health data to the wrong recipient via email, exposing sensitive health information.
• An insider bypasses security controls to access and exfiltrate medical records for malicious use, such as identity theft or selling PHI on the dark web.

Subjects with access to production and pre-production environments—whether as users, developers, or administrators—hold the potential to exploit or compromise highly sensitive organizational assets. Production environments, which host live applications and databases, are critical to business operations and often contain real-time data, including proprietary business information and personally identifiable information (PII). A subject with access to these systems can manipulate operational processes, exfiltrate sensitive data, introduce malicious code, or degrade system performance.

Pre-production environments, used for testing, staging, and development, often replicate production systems, though they may contain anonymized or less protected data. Despite this, pre-production environments can still house sensitive configurations, APIs, and testing data that can be exploited. A subject with access to these environments may uncover system vulnerabilities, access sensitive credentials, or introduce code that could be escalated into the production environment.

In both environments, privileged access provides a direct pathway to the underlying infrastructure, system configurations, logs, and application code. For example, administrative access allows manipulation of security policies, user permissions, and system-level access controls. Similarly, access to development environments can provide insights into source code, configuration management, and test data—all of which could be leveraged to further insider activity.

Subjects with privileged access to critical environments are positioned not only to exploit system vulnerabilities or bypass security controls but also to become targets for recruitment by external actors seeking unauthorized access to sensitive information. These individuals may be approached or coerced to intentionally compromise the environment, escalate privileges, or exfiltrate data on behalf of malicious third parties.

Given the sensitivity of these environments, subjects with privileged access represent a significant insider threat to the integrity of the organization's systems and data. Their position allows them to manipulate or exfiltrate sensitive information, either independently or in collaboration with external actors. The risk is further amplified as these individuals may be vulnerable to recruitment or coercion, making them potential participants in malicious activities that compromise organizational security. As insiders, their knowledge and access make them a critical point of concern for both data protection and operational security.

Subjects with physical access to critical hardware—such as data center infrastructure, on-premises servers, network appliances, storage arrays, or specialized equipment like CCTV and alarm systems—represent a significant insider threat due to their ability to bypass logical controls and interact directly with systems. This level of access can facilitate a wide range of security compromises, many of which are difficult to detect through conventional digital monitoring.

Physical access may also include proximity to sensitive areas such as network closets, on-premises server racks, backup repositories, or control systems in operational technology (OT) environments. In high-security settings, even brief unsupervised access can be exploited to compromise system integrity or enable ongoing unauthorized access.

With this type of access, a subject can:

• Extract or clone drives and media for offline analysis or exfiltration of sensitive data, including proprietary documents, logs, authentication secrets, and configuration files.
• Introduce malicious hardware or firmware, such as USB-based keyloggers, hardware implants, or modified components that persist beyond reboots and may evade traditional endpoint protections.
• Bypass access controls by booting from external media, altering BIOS or UEFI settings, or resetting system passwords using direct hardware manipulation.
• Install or modify software directly on the system, enabling surveillance tools, remote access backdoors, or malicious code that blends in with legitimate system processes.
• Capture network traffic by tapping physical interfaces or inserting intermediary devices such as portable switches, protocol analyzers, or rogue wireless access points.
• Disable security mechanisms, such as disconnecting monitoring systems, tampering with surveillance equipment, or disabling redundant power and failover systems to induce outages.

In operational environments, subjects with access to physical control systems (e.g., ICS/SCADA components, industrial HMIs, or IoT gateways) may alter processes, cause service disruptions, or create safety hazards. Similarly, access to CCTV or badge systems may allow them to erase footage, monitor employee movements, or manipulate access control logs.

Subjects with this form of access represent an elevated risk, especially when combined with technical knowledge or administrative privileges. The risk is compounded in environments with limited physical security controls, inadequate logging of physical entry, or weak segmentation between physical and digital assets.

A subject with access to customer data holds the ability to view, retrieve, or manipulate personally identifiable information (PII), account details, transactional records, or support communications. This level of access is common in roles such as customer service, technical support, sales, marketing, and IT administration.

Access to customer data can become a means of insider activity when misused for purposes such as identity theft, fraud, data exfiltration, competitive intelligence, or unauthorized profiling. The sensitivity and volume of customer information available may significantly elevate the risk profile of the subject, especially when this access is unmonitored, overly broad, or lacks audit controls.

In some cases, subjects with customer data access may also be targeted by external threat actors for coercion or recruitment, given their ability to obtain regulated or high-value personal information. Organizations must consider how customer data is segmented, logged, and monitored to reduce exposure and detect misuse.

A third party private organization deploys an individual to a target organization to covertly steal confidential or classified information or gain strategic access for its own benefit.

A subject facing financial difficulties attempts to resolve their situation by exploiting their access to or knowledge of the organization. This may involve selling access or information to a third party or conspiring with others to cause harm to the organization for financial gain.

A subject covertly collects confidential or classified information with the intent to sell or provide it to a third-party private organization.

A subject uses personal social media accounts to post statements or other media that can result in brand damage through association between the subject and their employer.

A subject uses existing access to social media accounts owned by the organization to post statements or other media that can result in brand damage.

A subject may misuse a corporate credit card for their own benefit by making purchases that are not aligned with the intended purpose of the card or by failing to follow the policies and procedures governing its use.

A subject with access to a billing system or indirect access to a billing system misuses their access to create fraudulent invoices, causing payments to be diverted to themselves, a business they own, or a third party.

A subject that self reports hours worked, and/or is eligible to claim overtime or an individual responsible for reporting such working time may falsify time records or make false representations to a working time system to cause payment or time in lieu for unperformed work.

A subject with access to sensitive or confidential information may decide to use that information to trade the company's stock or other securities (like bonds or stock options) based on significant, nonpublic information about the company.

A subject with access to a billing system or indirect access to a billing system misuses their access to modify existing invoices, causing payments to be diverted to themselves, a business they own, or a third party.

A subject misuses their direct or indirect access to dishonestly redirect funds to an account they control or to a third party.

A subject steals non-digital assets, such as physical documents, belonging to an organization.

A subject steals other digital assets, such as monitors, hard drives, or peripherals, belonging to an organization.

A subject steals a corporate mobile phone belonging to an organization for personal use, financial gain, transfer to a third party, or unauthorized access to organizational communications, information, and services.

The theft may result in financial loss, operational disruption, or exposure of organizational information and authentication mechanisms associated with the device. The nature and extent of the impact depend on the subject's intended use of the device, its configuration, and the security controls in place.

A subject steals a corporate laptop belonging to an organization for personal use, financial gain, transfer to a third party, or unauthorized access to the information and systems associated with the device.

The theft may result in financial loss, operational disruption, or exposure of organizational information stored on or accessible through the laptop. The nature and extent of the impact depend on the subject's intended use of the device, the information it contains, and the security controls in place.

The subject leverages synthetic identity elements, AI-generated visuals, deepfake video, or falsified credentials to obtain employment or contractor status under a false identity. This tactic is commonly used to gain insider access to an organization while avoiding standard background checks, attribution mechanisms, or compliance controls.

Common methods include:

• Using AI-generated (GAN-based) profile photos that cannot be reverse-image searched.
• Employing real-time deepfake tools during video interviews to alter facial appearance or impersonate another individual.
• Substituting a more technically skilled individual to complete a remote hiring assessment or interview under a fabricated identity.
• Presenting credentials or documentation (e.g., CVs, diplomas, certifications) created using forgery tools or generative AI.

This tactic is particularly dangerous when used to embed individuals in sensitive roles such as DevOps, system administration, SOC analyst, or software engineering, where access to production systems and intellectual property is granted shortly after onboarding.

Example Scenarios:

• A subject uses a synthetic LinkedIn profile with AI-generated imagery and falsified work history to apply for a remote DevOps role. During the live video interview, they use a deepfake overlay to match their fabricated profile photo.
• A technically skilled individual conducts a coding interview using a deepfake of another person, allowing a less qualified "puppet" to be hired under false credentials. The qualified subject later assists or directs actions remotely.
• A malicious actor obtains employment under an assumed identity to infiltrate a target organization on behalf of a third party, using synthetic documents and deepfake liveness checks to pass onboarding.

The subject deliberately alters their physical appearance to resemble an authorized individual or category of personnel—such as employees, contractors, vendors, maintenance staff, or delivery personnel—in order to bypass physical security measures and gain access to restricted areas. This tactic relies on exploiting visual trust cues (e.g., uniforms, badges, company branding) and is often used during reconnaissance or access staging phases prior to an insider event.

Common methods include:

• Wearing uniforms or branded clothing associated with the target organization or a trusted third party.
• Mimicking attire patterns of specific departments (e.g., IT, facilities, catering).
• Carrying props such as tools, ID lanyards, or delivery equipment to reinforce the impersonated role.

Example Scenarios:

• A subject dresses in a facilities maintenance uniform to gain access to server rooms under the pretense of conducting HVAC repairs, with no scheduled work order.
• An insider recruits an accomplice who dresses as a delivery driver to stage equipment drops and tailgate into a secure loading dock.
• During an internal staff shift, the subject wears a borrowed lanyard and IT polo shirt to move through restricted floors without being challenged.
• A former contractor retains high-visibility branded clothing and uses it months later to re-enter a secure building undetected.

The subject is a current or former asset of a nation-state intelligence service, operating inside the organization with pre-existing loyalty to, or direct affiliation with, a foreign government. Unlike insiders who develop espionage motives post-employment, this subject is often inserted, recruited prior to hiring, or cultivated externally over time and then encouraged to seek access to a target organization.

Their motive is the advancement of strategic objectives on behalf of a foreign nation-state. These objectives may include extracting sensitive information, degrading operational resilience, manipulating internal systems or decisions, weakening public or partner trust, or embedding long-term access for future exploitation. Such subjects may be formal intelligence officers, contract operatives, ideological affiliates, or individuals acting under recruitment, coercion, or influence.

Example Scenarios:

• A subject recruited during university by a foreign security service secures a role in a telecommunications provider and enables covert surveillance access for state-level eavesdropping.
• A subject hired into a biopharmaceutical firm has pre-existing links to a state-sponsored “talent program” and transfers research data to affiliated institutions abroad via covert cloud channels.

A subject with access to sensitive organizational data possesses the ability to view, retrieve, or manipulate information that is internally critical to the functioning, competitiveness, or integrity of the organization. This may include proprietary intellectual property, financial forecasts, internal audit reports, legal proceedings, incident investigation records, M&A materials, or internal threat detection logic. Access to such data is typically granted to personnel in roles including but not limited to finance, legal, security, compliance, research and development, or executive support functions.

While this data may not include customer information, its sensitivity is often equal or greater—particularly when tied to strategic decision-making, regulatory posture, or institutional trust. Misuse of access to sensitive organizational data can result in reputational harm, regulatory breach, loss of competitive advantage, or compromise of security functions. Because this access is frequently held by high-trust individuals or senior personnel, abuses may be harder to detect and more consequential in impact.

Unmonitored access to such data—particularly when permissions are inherited, overly broad, or poorly reviewed—can significantly elevate a subject's risk profile. This access may also attract external interest, such as social engineering attempts or recruitment by adversarial entities, making the subject a potential vector for external compromise.

A subject knowingly collaborates with an external individual, organization, or other third party to facilitate an infringement in exchange for an anticipated personal benefit. This may involve financial compensation, material rewards, professional opportunities, or other forms of personal advantage.
 

The arrangement may be initiated by the subject or the third party and can involve the unauthorized disclosure of organizational information, provision of access to restricted resources, manipulation of internal processes, or other actions intended to benefit the external party.
 

The defining characteristic is the subject's willingness to misuse their organizational position or access as part of a mutually beneficial arrangement. The anticipated personal benefit distinguishes this motivation from third-party involvement driven primarily by coercion, ideology, or other motives.

A subject proactively advertises or offers their willingness to misuse organizational access, information, resources, or position of trust to facilitate an infringement on behalf of a third party. This may involve publishing offers on underground forums, posting on social media, or directly approaching external individuals or groups seeking opportunities for unauthorized activity.

The subject may disclose details of their organizational affiliation, access privileges, technical capabilities, or the types of information and systems available to them to attract interested parties. Such activity may involve soliciting financial compensation, proposing arrangements for collaboration, or offering access to organizational resources in exchange for other benefits.

The defining characteristic is that the subject initiates the solicitation, positioning themselves as a potential participant in an infringement before any formal agreement or unauthorized activity has occurred.

A subject knowingly responds to recruitment advertisements, solicitations, or offers from third parties seeking individuals willing to misuse their organizational access, information, resources, or position of trust to facilitate an infringement. These opportunities may be encountered on underground forums, social media platforms, messaging services, or through direct communications from external individuals.

The subject may initiate contact with the recruiting party, express interest in participating, disclose their organizational affiliation or access capabilities, or discuss potential activities, compensation, and conditions of involvement. Engagement may progress from an initial expression of interest to more detailed discussions concerning the subject's ability to facilitate unauthorized access, information disclosure, sabotage, or other infringements.

The defining characteristic is the subject's voluntary engagement with an existing recruitment opportunity, rather than independently advertising their services. The behavior may constitute preparatory activity even where no agreement is reached or subsequent infringement occurs.