Criminal groups now recruit insiders openly, writes Dr Paul Wood. He argues that the approach itself is the earliest warning an organisation gets, but only if staff feel safe enough to report it.
This autumn the threat intelligence firm Intel 471 published Insiders for Hire, a study of insider activity on criminal forums, messaging channels and marketplaces. Of the 85 leads the researchers analysed, 45 concerned recruitment, making it the largest category by a wide margin. Criminals wanted employees who could look up restricted information, reset accounts, help with SIM swaps or reroute shipments. Transport, technology and telecoms were among the sectors mentioned most. Intel 471 is careful about what its sample can show. The sample is small, and an advert does not prove that a willing insider exists or that the access on offer is real. What it does show is what criminals are asking for and how they go about getting it.
Insiders cultivated
The methods will be familiar to anyone who has run a vetting programme. Recruiters posted public solicitations, made targeted approaches, paid referral fees and used brokers to find suitable staff. Some used deception. Others cultivated a prospective insider over time before making the ask. This changes the shape of the problem. We still tend to picture the insider as someone who goes bad on their own, through grievance or debt. Some are. Others are sought out. If criminals are shopping for access, staff in the roles they want, such as account administration, customer data or logistics, are likely to be approached at some point and most of them will say no.
The gapย
Most insider risk programmes are built to find the person who has already crossed the line. Effort goes into user monitoring, access logs and spotting unusual behaviour. Those controls matter. Their weakness is timing. By the time someoneโs activity looks wrong, the data may have gone or the shipment may already be missing. The approach comes earlier. Where an insider is recruited, a recruiter has to make contact first, and the person who receives that contact sees it. It might be a LinkedIn message offering well-paid โconsultancyโ or a stranger at a conference who becomes a friend. At that moment a loyal employee holds information the organisation needs: who is being targeted and for what access. If they report it, security learns about an attack before it starts. If they delete the message and say nothing, the recruiter moves on to the next name.
Why staff stay quiet
The reasons are ordinary. People worry that reporting an approach will make them look suspect, or that it will sit on a file and count against them at the next vetting review. Some are embarrassed that they replied before they realised what was going on. Many are unsure whether a vague offer counts. Few know who they would tell.
Past experience weighs heavily. Someone whose last report vanished, or led to an awkward interview, has already learned to keep quiet. My research on trust in security services, published in the British Journal of Social Psychology this year, builds on the well-established finding that trust is asymmetric: a bad encounter does more damage than a good one repairs. It also argues that fair treatment builds trust most when people see the authority as part of their own group. That work concerns public trust, but the logic carries inside an organisation. Staff report to a security team they see as on their side. One bad experience can undo years of goodwill.
Four practical steps
Say it plainly: tell staff that approaches happen and show them what one looks like: an unsolicited LinkedIn message, a โconsultancyโ offer that pays well for little, a friendly contact at an event who takes an interest in your access. Tell them that being approached says nothing bad about them. Criminals pick people for their roles. NPSAโs โThink Before You Linkโ campaign is free and includes staff guides, posters and an app for checking suspicious profiles. It was built mainly around hostile state approaches, though its advice on spotting and responding to a malicious profile works just as well against a criminal recruiter.
Make reporting easy and free of blame: give staff one route: a named person, a short online form or a phone number. Publish it where they will find it. Then put in writing that being approached will never count against anyone and that reporting promptly always counts in the reporterโs favour. What matters is what someone does, not who chose to contact them. For many cleared staff this is not a new rule, since vetting aftercare already expects them to report suspicious contacts. The aim is to make an existing duty feel safe to meet. Make sure HR and the vetting team hold to it, because one adverse vetting decision traced back to a report will travel round the building faster than any poster.
Prepare line managers: they are often the first to hear, usually in a corridor or at the end of a one-to-one. Give them a short script. Thank the person and tell them they have done the right thing. Take the facts: who made contact, how and what they wanted. Ask them to keep the message, screenshot the profile and not reply. Donโt interrogate. Pass it to security the same day. A manager who reacts with suspicion can close the channel for a whole team.
And close the loop: tell the person what happened next, as far as you can. Even โwe passed it on and it matched other approachesโ tells them the report mattered. Silence teaches people not to bother next time. Thank reporters publicly without naming them. A line in a staff bulletin saying that several colleagues reported approaches this quarter and that their reports helped makes reporting normal.
Measure that matters
Most programmes count insiders caught. A better early indicator is approaches reported. A rising count is usually good news, because it means staff trust you enough to tell you. It could also mean you are being targeted more, so read it alongside the wider threat picture. Either way, each report is a warning that arrived early. So ask yourself one question. If one of your staff were approached tomorrow, would you hear about it?
About the author
Dr Paul Wood CSyP FSyI is founder of Emerging Risks Global, a UK security, risk and resilience consultancy. He is also a Chartered Security Professional. ย
