Insider Threat Programs for Small Island Organizations

Summary of the paper

"The Insider Threat in Small Organizations" is an ISPI policy brief on why insider threat detection frameworks built for large institutions do not work in the small workplaces that make up much of an island state's economy: resorts, hospitals, port authorities, small government agencies and schools.

The brief argues that the detection failure in these workplaces is not a training failure but a framework failure. Standard tools assume dedicated security staff, anonymous reporting and institutional distance between colleagues, conditions that small island organizations typically do not have. It identifies four behavioral indicators that are routinely missed or normalized in these settings and sets out five policy recommendations.

What the paper finds

• Major frameworks assume organizational scale. Guidance from the Carnegie Mellon CERT Insider Threat Center, the National Insider Threat Task Force and the DHS Insider Threat Program assumes dedicated security personnel, anonymous reporting and distance between colleagues.
• Social cost suppresses reporting. Where professional and personal networks overlap, the social cost of a formal report is high enough that underreporting of warning signs is systematic rather than exceptional.
• Anonymous tip lines are not anonymous. Drawing on research on normalization of deviance and psychological safety, the brief argues anonymous mechanisms are largely ineffective where anonymity is structurally impossible.
• Four indicators need island calibration: gradual access privilege escalation, changes in financial behavior in high cost-of-living settings, social withdrawal against a high-connection baseline, and grievance expressed through indirect, high-context communication.
• Access logs are the most reviewable signal, because they create a digital record that can be checked without interpersonal friction, provided a third-party review mechanism exists.

What it recommends

• Replace anonymous tip lines with structured third-party assessment pathways that sit outside the organization's social network.
• Require BTAM-trained threat assessment training, adapted for small organizations, in critical island infrastructure such as ports, hospitals, utilities and government agencies.
• Commission island-specific behavioral baseline research to calibrate threat indicator thresholds.
• Establish third-party threat assessment referral mechanisms for small organizations.
• Include island-specific insider threat detection requirements in DHS security grant conditions for Hawaii and Pacific territory infrastructure operators.

Who it's for

Executives, HR and security leads in small island employers, critical infrastructure operators, county and territorial agencies, and DHS grant administrators.

Further reading

• Pacific Island Governments and the Case for Independent Security Research
• What Diplomatic Security Operations Teach About Island Institutional Security
• CM-07: The Invisible Insider
• CM-08: Calibrating for Community

Cite as

Pulley, Warren (2026). The Insider Threat in Small Organizations: Why Detection Frameworks Built for Large Institutions Fail Island-State Workplaces (ISPI PB-01). Island Security Policy Institute, Honolulu. https://ispiglobal.com/papers-landing/pb01-insider-threat-small-org https://doi.org/10.5281/zenodo.23449964

@techreport{ispipb012026,
  author      = {Pulley, Warren},
  title       = {The Insider Threat in Small Organizations: Why Detection Frameworks Built for Large Institutions Fail Island-State Workplaces},
  institution = {Island Security Policy Institute},
  address     = {Honolulu, HI},
  number      = {ISPI PB-01},
  year        = {2026},
  url         = {https://ispiglobal.com/papers-landing/pb01-insider-threat-small-org},
  doi         = {10.5281/zenodo.23449964}
}

Related analysis