Critical infrastructure: The insider risks background checks don't reveal

Insider risk can emerge or evolve long after access has been granted. External pressure, changing circumstances or exposure to high-risk material can become relevant indicators that personnel security processes and traditional cybersecurity controls are not designed to identify.

This is not about monitoring what employees believe or predicting how they will behave. It is about giving security teams verified intelligence on what their existing tools may be missing.

Insider risk doesn't stop after access is granted

Norway's National Security Authority puts it plainly: a security clearance is a snapshot of the situation at the time it is granted.

A UK government study of more than 120 insider cases, across sectors including energy, transport and telecoms, points the same way. Only 6 percent involved people who joined an organization intending to abuse their access. In 76 percent of the cases, “the individual saw an opportunity to exploit their access once they were employed.”

In many cases, the relevant behavior emerged only after the individual was already inside the organization. That is why personnel security cannot end when access is granted.

A changing threat landscape puts trusted access in focus

The European Commission notes that hostile actors have turned to sabotage of critical infrastructure and “to the use of terrorists and violent extremists as proxies.”

That interest extends to people who already have access. Norway's Police Security Service warns that recruited insiders can be asked to gather information about vulnerabilities in routines, security measures and IT infrastructure, which can then be exploited in future intelligence, influence and sabotage operations.

As tensions rise, people with trusted access become more attractive to outside actors. For organizations in critical infrastructure, government, defense and other sensitive sectors, human insider risk increasingly overlaps with national security.

The visibility gap in traditional security controls

Security teams in critical infrastructure watch closely for malware, intrusions, data exfiltration and misuse of privileges. Those controls are built to detect technical threats. They are not designed to identify high-risk content that may be relevant to human insider risk.

Nearly 270,000 enterprise devices analyzed for the Verizon Data Breach Investigations Report 2026 showed that roughly one in 500 employees had handled compromising or high-risk material on a corporate device. The presence of compromising material can increase an individual’s vulnerability to coercion or external pressure. When someone with trusted access is coerced, legitimate access can become a risk that may go undetected, even in mature security environments.

Bringing verified intelligence into existing security operations

Real-world cases also show why internal visibility matters. In 2015, a Norwegian oil services company identified activity that breached its internal guidelines and escalated the matter through established channels. The case illustrates a broader point: when organizations have relevant indicators and clear processes in place, they are better positioned to assess and respond to potential insider risk.

Terrorist and violent extremist content (TVEC) is one area where specialized intelligence can give security teams visibility they do not otherwise have. In a threat landscape where security services describe the use of violent extremists and recruited insiders as proxies, access to verified TVEC can provide relevant context for organizations protecting critical systems and sensitive environments.

We look at this more closely in When extremist content becomes an insider risk.

Verified TVEC Risk Indicators can be integrated into the security environments and workflows organizations already use. When a match is identified, it can be assessed through the organization’s established processes for investigation, escalation and response. A verified content indicator is not a verdict about a person. It gives the security team information it would not otherwise have, and the organization decides what happens next.

Strengthening resilience beyond compliance

From 2027, if a proposed Swedish law is passed, operators designated as critical entities will have to run background checks on people in certain positions and repeat them when there is reason to, and at least every two years. Similar requirements are taking shape across Europe as countries implement the EU directive on the resilience of critical entities.

Rules like these set the minimum. What happens between two checks remains the organization's responsibility, and operational resilience depends on seeing the risks that compliance alone does not reveal.