Commentary on insider threat risks specific to resort and hospitality operations in Hawaii and Pacific island environments.
Commentary on insider threat risks specific to resort and hospitality operations in Hawaii and Pacific island environments. Free under Creative Commons Attribution 4.0 — no registration required.
Summary of the paper
"The Invisible Insider" is an ISPI commentary on insider threat in Hawaii's tourism and hospitality industry. Hotel employees across housekeeping, maintenance, food service, front desk, concierge, security and management have legitimate access to guest rooms, belongings and data.
ISPI's practitioner analysis identifies this hospitality insider threat profile as systematically underassessed, because physical and digital access are usually evaluated separately.
What the paper finds
- Access is broad by design. Many staff roles legitimately enter guest spaces, so access alone does not distinguish a threat.
- Turnover compounds the risk. Workforce turnover adds to the breadth of access that has to be governed.
- Physical and data access converge. Property management systems hold guest personal and financial data, and neither physical security nor cybersecurity frameworks, evaluated on their own, fully capture the combined exposure.
What it recommends
- Assess physical access governance, behavioral baselines for island hospitality workforces and digital access to property management systems in combination, not separately.
- Establish Hawaii-specific hospitality insider threat assessment standards through the Hawaii Tourism Authority and the Hawaii Hotel Alliance.
- Commission independent hospitality insider threat assessments covering all three dimensions.
Who it's for
Hotel and resort general managers, security and loss prevention directors, HR and IT leads, and hospitality industry associations in Hawaii.
This research connects to the 39 Small Island Developing States worldwide through the Samoa Pathway and BPOA+30 framework. Every ISPI research product carries a mandatory SIDS global bridge per the ISPI Research Architecture.
Cite as
Pulley, Warren (2026). The Invisible Insider: Insider Threat in Hawaii's Tourism and Hospitality Industry — The Risk Nobody Is Assessing (ISPI CM-07). Island Security Policy Institute, Honolulu. https://ispiglobal.com/papers-landing/cm07-insider-threat-hospitality https://doi.org/10.5281/zenodo.23449917
BibTeX
@techreport{ispicm072026,
author = {Pulley, Warren},
title = {The Invisible Insider: Insider Threat in Hawaii's Tourism and Hospitality Industry — The Risk Nobody Is Assessing},
institution = {Island Security Policy Institute},
address = {Honolulu, HI},
number = {ISPI CM-07},
year = {2026},
url = {https://ispiglobal.com/papers-landing/cm07-insider-threat-hospitality},
doi = {10.5281/zenodo.23449917}
}Related analysis
AnalysisDuty of Care for Island Resort Operators: What the Lahaina Litigation and Hurricane Lala Established →AnalysisHow to Implement an Insider Threat Program in a Small Island Organization →AnalysisInsider Threat in Island Communities — Why Standard Frameworks Fail Worldwide →PaperCM-06 — Climate Security and Island Public Safety →PaperCM-08 — BTAM Cultural Calibration for Pacific Islander Communities →RegionResort and Hospitality Islands: The Island-Resilient Certification Program →GuideInsider Threat in Island Communities: Research and FAQ →Pulley, Warren. "Insider Threat in the Island Hospitality Industry." Island Security Policy Institute, 2026. https://ispiglobal.com/papers-landing/cm07-insider-threat-hospitality
