Buyer’s guide
How to procure insider threat training.
Start with the risk, then choose a health check, workshops or a program.
A practical guide for government agencies, Defence industry, critical infrastructure and corporate organisations planning to buy insider threat training: start with the risk, choose the right approach, write a clear statement of requirements and evaluate providers.
Key points.
The short version, for a buyer who has five minutes. The sections below give the detail.
- Insider risk is mostly a people risk: research shows most insider incidents come from negligence, not malice.
- Choose the approach to match how well you know your gaps: a health check, targeted workshops or a role-based program.
- Ask for training tailored to your policies and reporting pathways, with assessment and evaluation agreed up front.
- Avoid awareness-only, fear-based or generic training, and fix reporting processes alongside training.
Last reviewed October 2026. Prepared by Wisdom Learning, RTO 88062.
Who this guide is for.
Security, integrity, HR, risk and capability teams who need to build insider threat capability and are preparing an approach to market, whether they are working to the PSPF, DISP or the SOCI Act, or protecting intellectual property, sensitive data and research.
It is general guidance, not legal advice. Always follow your organisation’s procurement rules, including the Commonwealth Procurement Rules where they apply.
1. Start with the risk, not the course.
Insider risk is mostly a people risk, and research shows most insider incidents come from negligence rather than malice. Be clear about what you need to change before you choose a product. Common reasons to buy are:
- Meet a framework obligationShow how you manage insider threat under the PSPF, DISP or your critical infrastructure risk management program.
- Build a reporting cultureHelp people recognise behaviours of concern and feel safe to report them.
- Equip managersGive managers the confidence to notice change, have early conversations and escalate.
- Strengthen practitionersBuild the capability of security, integrity and HR teams to assess and respond to concerns fairly and lawfully.
- Respond to a findingClose a gap raised by an audit, review or incident.
2. Choose the right approach.
Not every organisation needs the same thing. Match the approach to how well you understand your gaps.
- An assessment or health checkWhen you are not sure where your gaps are. Reviews governance, policy, the personnel security lifecycle, reporting, access and culture, and gives you a prioritised plan.
- Targeted workshopsWhen you have a clear need, such as manager capability, practitioner skills, an executive briefing or a scenario exercise.
- A role-based programWhen you want capability across the organisation, built for each audience and evaluated over time.
Training alone will not fix a broken reporting pathway or unclear policy. Ask providers how they identify and address process and system gaps alongside training.
3. What to put in your statement of requirements.
A clear statement of requirements gets better, more comparable responses. Include:
- Purpose and objectivesWhat must change, written as outcomes you can measure, for example more confident managers or earlier reporting.
- Framework alignmentThe framework that applies (PSPF, DISP, SOCI Act or your own policy) and the requirements the training must support.
- AudiencesWhich groups need capability, roughly how many people, and their locations: all staff, managers, practitioners, executives.
- TailoringTraining built around your policies, reporting pathways and environment, not generic content.
- ScenariosRealistic scenarios relevant to your organisation, with no identifiable real cases.
- DeliveryFace to face, virtual or blended, session length, and any digital modules for large workforces.
- Assessment and evaluationHow capability will be assessed and how the program will be evaluated, with measures agreed up front.
- AccreditationWhether you need nationally recognised training. If so, check the provider’s scope of registration on training.gov.au.
- Security and privacyClearances required, classification of materials, and how sensitive information will be handled.
- Deliverables and IPMaterials, facilitator guides, reports, and who can use the materials after delivery.
4. How to evaluate providers.
What separates a provider who can change behaviour from one who can deliver a module.
- Insider threat and investigations expertiseDo their people understand how concerns are assessed and acted on, as well as what insider threat is?
- People as well as technologyDo they build human capability, and stay independent of any monitoring product?
- Role-based designCan they show different content for staff, managers, practitioners and executives?
- Fair and lawfulDo they cover procedural fairness, privacy and record-keeping, and avoid fear-based messaging?
- Evidence of impactHow do they assess capability and evaluate programs, and can they show examples?
- Security and discretionDo they have cleared facilitators and appropriate information handling?
5. Questions to ask providers.
Questions to put to every provider in a market approach, and what a strong answer sounds like.
- How will you tailor the content to our policies, reporting pathways and environment?
- What will managers be able to do differently after your program?
- How do you build reporting confidence without creating suspicion or fear?
- How do you cover procedural fairness and privacy?
- How will you assess capability and evaluate the program?
- How do you identify process or system gaps that training alone will not fix?
- Who will facilitate, and what is their background and clearance level?
- Can you show an example scenario or program outline, with client details removed?
6. Common pitfalls.
The mistakes that appear most often in insider threat procurements.
- Awareness only: a one-off module that ticks a box but does not change behaviour
- Generic content that does not match your policies or reporting pathways
- Leaving out managers, who are often the first to notice change
- Fear-based messaging that damages trust and discourages reporting
- Training people to report into a process that is unclear or not resourced
- No measures, so you cannot show what has changed
Questions buyers ask.
Short answers to the questions buyers ask about insider threat training. If yours is not here, ask us.
Is annual security awareness training enough?
Annual security awareness training is required under the PSPF for non-corporate Commonwealth entities, and it is a baseline. Insider risk is managed by people in different roles, so managers, practitioners and executives usually need role-based capability built around your policies and reporting arrangements.
Who should receive insider threat training?
Everyone with access to people, information, systems or places needs awareness. Managers and supervisors need to notice and escalate. Security, integrity and HR practitioners need to assess and respond. Executives need to understand obligations and oversight.
Does insider threat training need to be accredited?
Not always. Tailored training can meet most needs. If you need nationally recognised training, check that the provider is a registered training organisation with the relevant qualification or units on its scope at training.gov.au.
How do we measure whether insider threat training works?
Agree measures before you start, such as confidence to recognise and report concerns, manager escalation, quality of assessments and records, and changes in reporting, then evaluate against them.
How to engage Wisdom Learning.
Wisdom Learning offers three ways in: an Insider Threat Health Check, targeted workshops, or a role-based program, delivered with experienced insider threat, security and investigations professionals. Agencies can engage us directly or through government panels and arrangements; see our buying guide for the right route.
We respond to every enquiry within one business day.