Insider threat
Insider threat training and health checks.
Staff who notice, managers who act, concerns handled lawfully.
Insider incidents can be preceded by behaviours that someone noticed but did not report, or reported but no one acted on. Wisdom Learning helps government and corporate organisations understand their insider risk, then build the people, process and system capability to manage it. Whether you are building a program ahead of need, meeting PSPF, DISP or SOCI Act obligations year to year, or responding to an audit finding, review or incident, start with an Insider Threat Health Check, a targeted workshop or a full program.
People are the biggest insider risk, and the best defence.
Insiders have legitimate access to people, information, systems and places. Technology controls are necessary, but most of the warning signs are human: changes in behaviour, grievances, unexplained wealth, attempts to access information outside a role.
Organisations need people who notice, managers who act, and teams who can assess and respond fairly and lawfully.
- Can staff recognise behaviours of concern?
- Do people know how and where to report, and feel safe doing it?
- Do managers know their role in personnel security?
- Are concerns assessed consistently and fairly?
- Is information handled to the right standard?
- Are digital indicators connected to people indicators?
- Are responses lawful, proportionate and well documented?
- Can you evidence your insider risk capability?
The data: people are where risk starts.
Australian and global research points the same way: people are involved in most breaches, and most insider incidents are not malicious. Many involve negligence or error, which training and clear reporting pathways can help reduce.
- 62%of breaches involved a human element, such as error or social engineering.Verizon 2026 Data Breach Investigations Report
- 37%of data breaches notified in Australia in January to June 2025 were caused by human error.Office of the Australian Information Commissioner
- 53%of insider incidents were caused by employee negligence, not malice.Ponemon Institute, 2026 Cost of Insider Risks (sponsored by DTEX)
- 67 dayson average to contain an insider incident, at an average annual cost of US$19.5 million per organisation.Ponemon Institute, 2026 Cost of Insider Risks (sponsored by DTEX)
Figures are as published by the sources named. Global figures are drawn from large organisations and are reported in US dollars.
Three ways to work with us.
Start where it makes sense for you. Many organisations begin with a health check, others come to us with a clear need for a workshop or a program. Each can lead to the others. All are delivered face to face, virtually or blended, anywhere in Australia, by security-cleared trainers.
Insider Threat Health Check
When you want to know where you stand
- An external view across six domains
- Priority gaps and an uplift roadmap
- People, process and system recommendations
Workshops
When you have a specific need
- Awareness, managers, practitioners or executives
- A scenario exercise across security, HR, IT and legal
- From a short briefing to a full day
Programs
When you want capability across the organisation
- Role-based, for every level
- Built around your policies and reporting
- Assessed and evaluated, with nationally recognised options
Option one
Insider Threat Health Check.
If you are not sure where your gaps are, start with a health check. It gives you an external view of where you stand and a prioritised plan for the people, process and system uplift likely to reduce your risk most. You are free to act on it with us, with others or in-house.
- ScopeAgree the scope, the framework that applies (PSPF, DISP, SOCI Act or your own), and who we will speak with.
- ReviewReview your policies, procedures, reporting pathways and past concerns.
- ListenInterviews and workshops with security, HR, IT, legal, managers and staff.
- AssessAssess maturity across six domains, against the framework that applies to you.
- Uplift planA clear report with priorities across people, process and systems, and a practical roadmap.
What we assess
- Governance and accountability
- Policy and procedure
- Personnel security lifecycle
- Reporting and response
- Access and systems
- Culture and capability
What you receive
- A maturity rating for each of the six domains
- The priority gaps that create the most risk
- A practical uplift roadmap across people, process and systems
- Quick wins you can act on straight away
- A short executive briefing on the findings
What happens next
- People uplift: workshops and programs for staff, managers, practitioners and executives
- Process uplift: policies, reporting pathways and response procedures
- System uplift: access and monitoring improvements, delivered with our partners
- A follow-up check to show what has changed
Option two
Workshops that meet a need.
Start with a single workshop, or combine them into a program. Each is built around your policies, reporting arrangements and real situations, and runs from a short briefing to a full day, face to face or online.
- Insider threat awarenessFor all staff with access to people, information, systems or places: recognising behaviours of concern, reporting, and protecting sensitive information and assets.
- Managers and supervisorsNoticing change, having early conversations, supporting staff and knowing when and how to escalate.
- Assessing and responding to concernsFor security, integrity and HR practitioners: gathering information, assessing concerns and responding fairly, lawfully and with good records.
- Executive briefingFor senior leaders: insider risk, your obligations, and what a mature insider threat program looks like.
- Insider threat scenario exerciseA facilitated tabletop exercise that tests how security, HR, IT and legal work together when a concern is raised. About our exercises
- Insider threat program designHelp to design or mature your insider threat program, roles and reporting pathways.
Option three
A program for every level.
Insider threat is everyone’s responsibility, but each group needs different capability. We build it role by role, around your policies and reporting arrangements.
All staff with trusted access
Awareness that leads to action
- What insider threat is, and is not
- Behaviours of concern and the pathway to harm
- How and where to report, and what happens next
- Protecting information, systems and places
- Contact reporting and approaches from others
Managers and supervisors
The front line of personnel security
- The manager’s role across the employment lifecycle
- Noticing and having early conversations
- When and how to escalate
- Supporting staff without compromising security
- Grievances, wellbeing and change as risk factors
Security, integrity and HR teams
Assessing and responding
- Insider risk frameworks and programs
- Assessing concerns and gathering information
- Investigation-informed decision-making
- Procedural fairness, records and privacy
- Working across security, HR, IT and legal
For government and corporate organisations.
Insider risk obligations now reach well beyond Commonwealth agencies. Our programs are built around the framework that applies to you.
- Commonwealth entities: the PSPFNon-corporate Commonwealth entities that manage Baseline to Positive Vetting clearance holders must implement an insider threat program (PSPF Requirement 0051). An effective program covers governance, personnel security, security culture and awareness training, access controls and response.
- Defence industry: DISPDefence Industry Security Program members must meet personnel security obligations, and cleared personnel complete annual security awareness training.
- Critical infrastructure: the SOCI ActResponsible entities must manage personnel hazards, the trusted insider risk, in their critical infrastructure risk management program. Obligations apply to specified critical infrastructure assets, including electricity, gas, liquid fuels, water, broadcasting, data storage or processing, payment systems, designated hospitals, food and grocery, and freight infrastructure and services.
- Corporate and research organisationsOrganisations with valuable intellectual property, sensitive data or research face the same people risks, whether or not a framework requires them to act.
This is general information, not legal advice.
Experienced professionals, one accountable partner.
Wisdom Learning partners with experienced insider threat, security and investigations professionals. You work with one accountable team that brings practitioner insight to the health check and the uplift, with Wisdom Learning designing, delivering and evaluating the capability.
- PeopleWorkshops, programs and assessment for every level
- ProcessPolicies, reporting pathways and response procedures
- SystemsAccess and monitoring uplift, with our partners
What makes our approach different.
Insider threat is a people problem before it is a technology problem. Our programs are built on that premise.
- Investigation-informedBuilt on our investigations practice, so people understand how concerns are assessed, evidenced and acted on, fairly and lawfully.
- Targeted from the startA health check, or a short needs analysis for workshops, makes sure every session targets the gaps that create the most risk.
- Scenario-basedRealistic case studies and scenarios drawn from your environment, not generic videos.
- Aligned to your frameworksBuilt around the PSPF, DISP, the SOCI Act or your own policies, whichever applies to you.
- Assessed and evaluatedCapability is assessed, and programs are evaluated, so you can show what has changed.
- Delivered with discretionSecurity-cleared trainers who understand sensitive environments.
Across the personnel security lifecycle.
Insider risk does not start or stop at a clearance. Our programs address the points in the lifecycle where insider risk is highest.
- JoiningClear expectations and obligations from day one.
- OngoingNoticing changes, early conversations, reporting and ongoing suitability.
- ConcernsAssessing and responding to concerns fairly, lawfully and consistently.
- LeavingManaging access, obligations and risk when people move on.
A taste of how we work.
Every program uses realistic situations drawn from the work. Here is a short example of the kind of scenario participants practise.
Nationally recognised training
Qualifications for practitioners.
Security and integrity practitioners can build their capability towards the PSP40316 Certificate IV in Government Security, including its personnel vetting specialisation, and the PSP40416 Certificate IV in Government Investigations.
- PSP40316Certificate IV in Government SecurityView qualification
- PSP40416Certificate IV in Government InvestigationsView qualification
Delivered and assessed by Wisdom Learning Pty Ltd, RTO 88062. Tailored insider threat programs are not nationally recognised training unless a qualification or unit code is shown.
Related.
Pages buyers of this capability usually read next.
- Responding to audits, reviews and new obligationsTreating PSPF, personnel security and insider risk findings, with evidence for your committee.Explore
- Security capabilityProtective security capability aligned to the PSPF, including construction security.Explore
- Investigations, intelligence and regulatory capabilityThe investigations practice behind our approach to assessing concerns.Explore
- Defence, national security and protective securityHow we work with national security agencies and Defence industry.Explore
- Buyer’s guide: procuring tabletop exercisesPlanning an insider threat scenario exercise? What to ask for and how to evaluate providers.Explore
Questions about insider threat programs.
Short answers to the questions organisations ask us about this work. If yours is not here, ask us.
What is an insider threat?
An insider threat is the risk that someone with legitimate access to an organisation’s people, information, systems or places uses that access, knowingly or not, to cause harm.
What is the Insider Threat Health Check?
It is Wisdom Learning’s structured assessment of your insider risk arrangements across six domains: governance, policy, the personnel security lifecycle, reporting and response, access and systems, and culture and capability. You receive maturity ratings, priority gaps and a practical uplift roadmap across people, process and systems.
Do we have to start with a health check?
No. The health check is one way to engage us. You can book a single workshop, a scenario exercise or a full program. Every workshop and program still starts with a short conversation about your context, policies and reporting arrangements.
How long does a health check take?
It depends on the size of your organisation and the scope agreed, from a focused review of one business area to an organisation-wide assessment. We agree the scope and timeframe with you before we start.
Do you fix the system and technology gaps?
We do not sell technology. We deliver the people and process uplift, and work with our partners on access and monitoring improvements where they are needed.
Is your insider threat training accredited?
Tailored programs can include nationally recognised units from our scope, and practitioners can work towards the PSP40316 Certificate IV in Government Security or PSP40416 Certificate IV in Government Investigations, delivered and assessed by Wisdom Learning, RTO 88062.
Does this replace mandatory security awareness training?
No. It builds on mandatory security awareness, including annual security awareness training for cleared personnel where it applies, with role-based capability around your organisation’s policies and reporting arrangements.
Can you train managers and HR as well as security teams?
Yes. Managers and HR are central to insider risk. We build their capability to notice, have early conversations, escalate and respond fairly.
Do you work with corporate and critical infrastructure organisations?
Yes. We build insider threat capability for government agencies, Defence industry and corporate organisations, including critical infrastructure entities managing personnel hazards under the SOCI Act.
Do you have security-cleared trainers?
Yes. We deliver with security-cleared trainers and work with the discretion sensitive environments require.
Your people are your best defence.
Book a health check, a workshop or a program, or talk to us about where to start.
We respond to every enquiry within one business day.