Inside the Insider Threat: A Systemic Approach – A Conversation with Pierre Skorich

Hello, welcome to the Australian Institute of Insiders Threat. Hi, I'm Boz Fisher and I'm thrilled you're here today as we have a very special guest. Pierre Schorris is not just an acclaimed author, but also a sword leader in the field of insider risk. He's the co author of this amazing book called Insider A Systematic Approach along with Matthew Manning and we're going to actually bring this book to life. He's going to give us some of his thoughts, ideas, his process of how he came across this book. So if you're a chief Information Security officer, an insider risk steward, or just a scholar, you're in for a treat. So come and join me and let's get started before we get going. Pierre, thank you very much for joining us. I'm really looking forward to talking it. Can you give us and the viewers sort of a bit of your background and your role of who you are and so forth?

Yeah, no worries. Well, firstly, thanks for having me. It's a real pleasure, I guess, to tell you about my background. I've chiefly worked in the federal government, but across a whole range of different fields from policy making, very strong background in law enforcement, national security and regulatory organizations. And that's how I came to take an interest in Insider Threat was primarily through working with big regulatory organisations and occupying in a couple of organisations, those functions. And I've also worked very closely with the Commonwealth Fraud Prevention center in the Attorney General's department as well. So kind of a broad base and have a very strong interest, I guess, in risk governance and kind of organizational systems.

Excellent, excellent. Well, before we start with the questions, I just wanted to give you sort of my own perspective of the book. I very much enjoyed it. I'm sort of a type of person that when I take a book I sort of highlight. I read a few pages and I said, okay, I got to think about it, it's got to steer my mind. And so I end up, you know, putting heaps of notes, wrote it, you know, caption and so forth. So very much enjoyed the book, had some great nuances and so forth like that. So let me start by asking you what inspired you to write about it.

Yep, there's probably a few things. Like I said, I came from a regulatory background. One of the things that I did a long time ago was being involved in the setup of the clean energy regulator. And I was in charge of basically setting up the operating model for the organization, which was all about a very structured approach to understanding the regulatory risk and deploying our resources and assets to that regulatory risk. And then I came into another organization to basically take over the insider risk, internal fraud sort of functions. And I guess what I found looking at it and comparing the kind of work that I'd done before was that there isn't a lot of maturity or there hadn't been a lot of maturity in dealing with insider risk really in organizations anywhere that I'd really seen A lot of things focused very much on kind of the events of the risk. So you end up with, you know, spreadsheets with big long lists of risks in them. There was also a lot of focus, I guess in the narrative about, you know, bad people and how you stop bad people from doing bad things and that sort of stuff. So it was very people centric and there was a lot of focus also I guess on reporting mechanisms and tip offs and like immediately I see that a lot tip offs like they're an important part of a system but they are also like prone to a lot of issues. And one of the case studies from that particular organization was exactly where tip offs really had not worked because people were in, on a, in a kind of a network of insider threat working together. Other people sort of saw things but they didn't really recognize what they were seeing. So effectively that whole process failed in a very, very major way. So it was a real stark example of that not being the strongest way of really dealing with insider threat. And using some of that background to that organization, I developed a framework which eventually became what the book is about, which is I looked through all of the functions of that organization and really spent a lot of time actually watching what happened. So like in different functions within the organization, observing how it was done, who was involved, what sort of checks and balances were in place and that sort of thing. And from that put together a structured framework for understanding risk within that organisational context. And then the last bit of the story really is I came to work with Matt Manning on a very different body of work really. It was about we started doing some thinking about a anti money laundering and counterterrorism financing harm index.

Oh wow.

We had conversations about, you know, this, this framework and he is one of the top academics in the crime science field and he had a look at some of this stuff and said there's really nothing like this out there and it should be put into a book so other people can use that knowledge. So that's what we set about doing.

Now I was very much curious to see what's the collaboration that you have with Matthew Manning. So you sort of preempted me. That's great. You mentioned in the book sort of a new framework for understanding inside of risk by focus on organization systems. How does the systematic approach differ from traditional methods of addressing insider threats?

Yeah, so I guess there's a couple of ways of looking at that. One of them I might start with the easy one, which I think is there's a lot of focus in organizations, from my perspective, on the enforcement end of. So it's very much about, you know, the tip off and then dealing with the people, you know. So those people need to go through code of conduct investigations, correct. Criminal investigations and that sort of thing. But that's dealing with the problem after it's occurred. So it has no prevention element to it really, other than a kind of a tenuous relationship to deterrence, which we kind of know. Unless there's a very strong detection mechanisms, deterrence doesn't necessarily have a very strong impact. So that's, I guess, one thing. The other side is how risk is assessed. So I sort of touched on this before. I've been in multiple organizations and it's across the risk field, right. There's a lot of focus on what's the risk event. And that means you come up with big long lists of different types of events. Someone could, you know, defraud their credit card, they could do this, they could do that. And so comes up with a big long list of sorted things. And often those things are not necessarily the most critical ones, but they're the ones that you can recall the easiest. I think I use the credit card example in part because that's one that I often hear, I think. Well, but credit cards, it's really important, right? And the financial management is an important thing, but it's not actually critical. It's not your business success, Right?

Yes.

Particularly when you think in the government, a government kind of context, you have a mission that you're set up to and the, the credit card is a part of that. It's an input, but it's not the mission itself. And so you're not necessarily focusing on the things that are going to create the greatest harm. So as a result, the thing that changes, I think from my perspective is looking at it through the, the lens of the organization design. What are the mission that you're trying to achieve? How does insider threat therefore impact on, on that mission and objective? What are therefore the assets that contribute most to that thing and how are they exposed? And what it suggests is that you should understand the architecture of the organization and then suggest that you've got basically three kinds of assets that organizations have that contribute to that people is kind of one. But, but in terms of insider threat, it's really about the decisions that people are able to make within the organization. The tangible and intangible types of assets, the things that we actually use to do things, whether it's computers or whatever, X ray machines and the information that you hold in order to enable those things. And they become effectively the center of a model. And what that really is doing then is saying let's not think about the risk event, let's think about the drivers. So those are the kind of the targets. But then it's also understanding, well, what, what provides the opportunity for a person to actually, you know, follow through with an insider threat, whether it's like deliberate or inadvertent, what are the motivations for it, who's actually benefiting from it, if there's an external entity that's involved in it and how do they play in that field? Sometimes location is an important element as well. Insofar as you've got, you know, different things happen differently in different places.

Correct, correct.

And I guess then there's the other elements of it too, that, so this, that's just about the risk assessment process. But you've got other elements that are part of controlling the risk. And I think culture plays a really important part.

Sure.

Does the risk controls play an important part? Assuring those controls plays a really important part as well. So you can't just sort of say again, this is something that I saw in risk assessment. They're written down on paper, but do you have confidence that they're really there? Do you have confidence that they're working?

That is so true. So true. You mentioned in the book about other approaches to insider risk in terms of interventionism, managerialism, organization integrity. What are your thoughts in terms of those, those approaches compared to what you've written in the book or your thinking?

Yeah. So the interventionism kind of model really was almost what I was touching on before. It's very focused on those kind of punishments and that sort of thing. Yeah, the organizational integrity model is interesting, I think insofar as like what it's about is promoting, I guess, a sound and integrity based culture for an organization that's reflected through its systems of management, which I think is a really important component. I think one of the issues with the kind of the previous view of those is that they're seen as mutually exclusive. Like you can't have all of those things together. To me, a managerialist model is about governance and the putting in place of those mechanisms of control. And you do that in part through creating culture. You do it in part through those kind of physical and system kind of controls. And you do need to have things that respond to incidents, including ways of dealing with people who have gone and done the wrong thing. So that. So seeing them as exclusive from one another, I think is a weakness in. In some of those models. It's actually part of, again, a system that comes together.

Yeah. You mentioned sort of an overview of how you came across the idea of developing a sort of a systematic approach. But why is that important?

I think the real, probably the crux of why it's so important is because organizations have finite resources to invest in anything that they do. So if you're unsystematic or systemic in the way that you assess risk, you're going to equally be unsystematic and unsystemic in the way that you deploy those resources.

Yeah, correct. Correct.

And you're never going to be able to put it in the right places. And therefore, some of those very big things that can really significantly impact on your organizational objectives might be left totally exposed while you're dealing with these things that are effectively kind of rats and mice. And that's kind of what I've seen in reality, is that those resources don't necessarily go to the critical. Then the organization gets caught by surprise by something that it thought was not a problem because it hadn't seen it before. Right. Just because you haven't seen something before doesn't mean it's not possible. And so having a systematic approach is really about understanding risk really well and therefore understanding how you deploy your assets and resources to deal with that in the most efficient and effective way possible.

Yeah. You mentioned quite a bit about the complexity of organizations and so forth. How does a systematic approach deal with. Well, every organization is unique, so they'll have their own unique problems and challenges. But I'm sort of interested to hear your thoughts about how does sort of a systematic approach look at complexity.

Yeah.

And dynamics of. Of an organization as such.

Yeah. I guess, again, this kind of. It sounds very dualist, but organizations are complex and different, but in many ways they're also very much the same.

Yeah.

So again, like, for me, having worked in so many of them, you see that actually the regulatory systems that we employ are actually very much the same thing. Like, quite often what we're trying to do is we're controlling the entry into a market, we're controlling how someone behaves in that market and then how they exit from that market. And we do that through things like registering people. We get them to report on things. We get them to, you know, they have to report correctly. We give them some benefit or we take something away from them. And all of those things are very similar. We have powers that allow us to do that. So whether it's about the power to collect information, the power to apply penalties, all of those sorts of things. So they're actually very similar in that way. And that's, I think looking at them in, in a systemic and organizational design way helps you to identify what those elements and similarities are and have a structured way of kind of working your mind through that complexity. You've got a model to think about it. And I think that I forgot the end of what I was going to say then.

Yeah, I'm talking about from a perspective of the complexity nature of an organization because I think it's funny because when I sort of speak to organizations, they usually don't know where to start, number one. So. Because they've got so many moving objects and the thinking is, where do I start and how do I solve it?

Yeah.

And. Yeah, yeah.

So what I was going to say was I think the classification of if you can't. I did this talk about this a long time ago, which was about if you can't classify what you can't describe, you can't manage. Right. But if you've got a classification system for things, then you can describe what they are and you can describe how they link to one another. And there's one, one chapter at the end of the book which, which I really dedicate to trying to put all the elements together again. So it's like most of it goes through what are all of these pieces that make up this problem. But then at the end it's how do all of those elements of things fit together? Like opportunity is a thing that attaches both to the assets that you've got and to the roles. It's the people that have those opportunities based upon what powers that they have within the organization and things like that. And that's systematic approach, I think, helps you to again understand the problem in a much more deconstructed way. Like it allows you to understand what those different elements are and to think about them consistently all the way through the risk assessment process. I think the other thing that it does is it also helps you to think about controls in a really structured way. So again, in the book I've given a catalog of controls. The way that catalog kind of emerged was thinking about well if these are all of the elements of the risk, well why don't we just think about what effect do we need to have on those things? Like we need to have an effect on opportunity. So we need to have things that prevent opportunity. We need to have things that detect where that opportunity has arisen and then we need to have things that respond to the incidents if they arise. And having that effect based kind of thinking about control also helps you to identify what is it you're trying to control and how do you control that thing.

Yeah, I very much like an exit in the book and let me read it out. You said managing insider risk cannot just be a frivolous exercise for interest sake, but should be result immeasurably better outcomes then a system which does not protect itself from three. I think it's really important but I'd love to get your thoughts about that.

Yeah, I guess the, the underlying premise there is really that if you're going to invest in putting a system in place, it should work right. Like it's as simple as that. You don't want to be as an organization and as the CEO of that organization or whatever the managing body of it is, investing money in something that doesn't make the world and your organization a better place and reduce the harms that might otherwise occur. So making sure that it's not just an exercise of sort of ticking boxes or undergoing the process because like something else tells you that you should do that. It really is actually it's part of the protecting the objectives of your organization. And I think from the kind of senior management perspective, it's really part of meeting the obligations of risk management to the organization that help you fulfill the role that you have.

Very much so. I look, I've seen very much ticking the box when it comes to compliance and that doesn't mean it's secure, it's just.

And it's important because it's about the organization's success, right? Surely.

Yep.

It's not. It's not sort of like again if we think about it through the bad people lens, then it's only about sort of dealing with those things. Whereas when we're thinking about it as actually integral to treating risks that can affect the organization achieving its objectives, it becomes much more significant in your mind about how that needs to fit within the organization's risk frameworks.

Very true, very true. How has your perspective evolved throughout your research and routing over this period? How long did it take you to write the book.

It was, I mean it's, I suppose it's been a long time coming in my head. It probably took me about 12 months, but it was over weekends. I was part of the implementation of the National Anti Corruption Commission and my weekends were all taken up trying to write everything down. But like, in terms of the thinking processes, it's been much longer than that. I think in terms of evolution, there's probably a few nuances in there that I've come to over time, particularly while I was writing them. But overall, I would say the experiences both of writing, researching and then looking at things in an organization has probably reinforced my view that a systemic approach is the way to make things better. Because I've looked, you know, looking at case studies while I was writing the book, I'm like, well, I can identify all the elements of this case and how that might have been better assessed and better managed before it occurred. Here you can see the element of who, who was, you know, who committed this thing. You can see the elements of what opportunity they took advantage of to do that. You could see the element of, you know, who was benefiting and how they, they became involved and how they, you know, know, sometimes groomed people. And so all the elements kind of made sense. I did. There's a chapter there which talks briefly about CCTV and active and passive CTV as a control. Again, like there's a chapter that's kind of dedicated to thinking about the effectiveness of controls and the types of things that we do to assure them and stuff. Reading that CCTV bit and thinking about, you know, what's the threshold at which someone looking at screens is going to be able to assess what's going on and when do we go past that, that simple example of we really need to think about these controls because just thinking you've got cctv, you're okay is not the same thing as understanding, like how far you can push the bounds of that as a control and having a strong understanding of them. So all of those things kind of reinforce my, my view that actually that there is something really, I hope that that helps organizations to think better about this stuff.

Yeah, no, no, it's great, it's great. What role do you think of human behavior and psychology plan in the systematic approach and how do you incorporate these aspects into your framework?

Yeah, yeah. So there's a few different ways. One of them is in the risk assessment process. I talk a reasonable amount about the, the role of heuristics in the way that again, non systemic type risk assessments often play out, you know, so things like confirmation bias, you know, we see this thing, so we think that's the way that the world works and like we've got a preconceived view and so we, we, you know, want to fit that into things. Differs very much from a kind of a. A more scientifically based approach. So, yeah, heuristics play a very big role if we're not careful in making risk assessments less effective than they could be. So that psychological, you know, input to the way that we assess things as humans, I think is an important component that I talk about. I've sort of touched a bit on motivation. So there's parts dedicated to thinking about the motivation and very much drawing on, you know, the traditional fraud triangle. The. The. Yep, yeah, Catch up rationalization, but also adding to it, the inducement element, which is to me is the bit that's like the actual physical bribe or the threat or whatever it is that actually provides the catalyst at that point in time for things. So it's also an important element because we can't, even though I say, you know, we need to think about it through an organizational system lens, people are part of that system, so you need to understand them just as much. You just need to understand what. That they're not as systemic as all the other parts. Right. People get motivated by entirely different things because we are very different to it.

Yeah, that's true. Yep.

And then the other part, I think is, you know, we touched on the culture element and we need to think about that both in terms of understanding how current cultures within an organization, from a diagnostic perspective, can contribute to insider threat. And also from that perspective, then how do we improve the culture towards integrity, towards, you know, reducing things like rationalisation and so on. Like if people are unhappy within the organization because they aren't treated well, because the culture is not good, that has, I think, a contributing factor to insider threat. So we need to think about those cultural elements as well.

Yeah, very much so. In your singing, how do you address or approach an inside dual nature as being an asset and also being a potential risk to organization? It's a bit like the yin and yang, isn't it? In some ways, yeah. Yeah.

I think one of the things that I've often said is like really having a strong insider risk system is about protecting your people. So yeah, I think a lot of the time there's this kind of premise that someone, you know, you see the case studies and here's someone who has, you know, done something, they've facilitated you know, some terrible activity or they've stolen information or they've been responsible for sabotaging an organization or whatever it might be. But. And I think the, the premise is often that they are just an inherently bad person.

Yeah.

The reality is that they have come from somewhere and they've ended up there. And there's often, I think, you know, it's that. That saying about there but for the grace of God or whatever that there go I. There are, you know, people who. And again, there are case studies on this who are just like everyone else. They've come into an organization, they wanted to do their best work, and something's happened and they just happen to have been exposed to the wrong people when they were at a point of vulnerability and, you know, they've been groomed or whatever. And, and so they end up being compromised at that point in time. So. So we've almost let them down if we let them get to that point, because otherwise perhaps they would have been a great employee if we'd had the right kind of layers of protection around them. So I think we do need to treat them as if they're, you know, their asset to the organization as a, as a, an employee and put layers of control around them, but recognize that they are also the actor in the system as well.

Yeah, very much so. Now, I'm very glad you mentioned that. How. Actually, what I want is. Can you elaborate between the idea of proactive prevention compared to reactive response? I mean, there's a lot, there's a lot of talk, and I understand both are important, but I just want to sort of hear from your perspective.

Yeah, I think the, the balance, from my perspective is generally speaking, prevention works at a population level, while reaction works at an incident level. So if you think about it from an investment perspective, you've got an amount of investment that you put into dealing with problems at large, or you can deal with a series of incidents, each one of which you've got to invest individually. So from that perspective, like, it's inherent that I think that prevention plays a very, you know, it needs to play a stronger role from organization perspective. The other thing I think is often the harm can have occurred by the time you get to your reaction space, depending on how quickly you're able to detect and react. But so in some ways it hasn't actually solved your problem, it might solve the next one.

Yeah, correct. Correct.

But sometimes that if you, if you also don't have a link between your reaction and your. Your finding of whatever it is that you've found and then creating prevention for the future incident. And often I see that you've done the, the work to investigate someone and to prosecute them or whatever it is, or you've just, you know, you fired them. But the next person who occupies exactly the same role is in exactly the same position. So you've not actually solved the problem really. You've just dealt with the incident.

Correct. There hasn't been any learnings that have been adjusted and so forth. Now, you mentioned the importance of culture within an organization. So there's two points that I wanted to ask you. Do you think organizations just take it as default? And number two is you also mentioned in the book about, you know, having different layers or different subcultures within an organization culture. How do you think that adds complexity to the environment of insider risk?

Yeah, I would say organizations, I think they're getting better at it, but often don't actually understand what their culture really is. So like, we don't. We sort of, like you say, take it for granted that like this is the, the culture you come in, you normalize what, what's done in there and don't necessarily think that culture is something that you can play an active role in shaping. I think that is changing. I think organizations more and more are recognizing that culture is something that they need to shape in order to get the best out of the assets and people that they, that they have. And so more investment is being put into that. You know, I always take the, the quote of Peter Drucker about culture eat strategy for breakfast.

Yeah, I know Peter.

And I think that's more and more about the way that organizations are thinking. I think from that perspective, then getting to your point about subcultures is recognizing like what, what are the things that are shaping the, the culture at a whole of organization level might be different depending. It's particularly on size and distribution and things like that of organizations that different kinds of cultures are going to form. And you need to understand whether those things are more or less exposed. So I use the examples of like, say, for example, you've got parts of the regulatory system where you're working much more closely with industry, for example, than you might be with head office. So you know, they work, people work in state offices, they work very closely with, with people that they are regulating. So naturally their culture is going to be, you know, more closely aligned to the people that they tend to interact. So you need to understand that, that whatever you're doing at the center might not necessarily have the same effect in those things. Unless you're really putting that extra mile into understanding it and doing something about it.

Yeah, yeah. No, that's very interesting. What do you think is the biggest misconception organization have about insider threat? And then secondly, how does your book address this sort of misunderstanding? If, if there is.

I'm just, I think with industry, for example, then you might be with head office. It couldn't happen here. I think that's probably the one that again, I've seen the most. It's like the places where you've still got vulnerabilities and there's like a sort of a lack of belief really that it's a possibility until it occurs. And then suddenly everyone's reacting to the issue that's now occurred. But prior to that there's, there's a bit less of an understanding that, of the possibility of it, even though the risk exposures there. And, and most likely it's also that they've just, they don't have the systems of detection in place and that's why they haven't seen anything before is because.

No, Correct, correct.

They haven't put anything in place to find out whether it is or isn't.

Yeah, it's a bit of the chicken and the eggs, you know, if you don't know what you have, then you never know that you have something.

Yep, yep.

Which then leads me to the following question, is why do you think senior governance bodies do not consider insider straight practices as a core component of their business strategies?

It's probably also for the same reason. Right. If, if you're, if, if you're not exposed to it as being a part of the critical risk to the organization, and you're not, you don't have mechanisms to find out whether it is an issue or not, then boards naturally are thinking, we've got other things to figure out.

Correct.

And so they're not necessarily investing in those. And it's, I mean, it's the same across a whole range of different regulatory spheres, I think, where. Or risk management spheres, where until you start really looking, that's when you're going to find that actually there's more exposure and that exposure to your business objectives may actually be higher than other things that you're currently focusing on. I also think it's, it's, and again, I touch on this a bit in the final chapter is having someone who has responsibility and accountability for the system is a really critical component because then they have someone who is, you know, he's charged with looking at it and understanding what the size of the problem is, and if that person, if no one exists to do that, and it doesn't have to be someone separate, it could be the CRO or it could be whoever, but someone charged with that role is going to then try and understand the exposure the organization has and provide better advice to the board than if you don't have anyone that has a role of that caliber.

Yeah, very much so. So you had over 10 years across various government departments and so forth. How have Insider straight evolved during that period and what, what emerging new trends are you seeing or being aware of?

I would say there's a, probably a range of different things. I think the way that we do business has obviously evolved very quickly with automation and. Yeah, automation and the way that we now kind of deploy our business into the world, I suppose, like we've obviously got much more involvement of ICT people in our business structures and they're not a place to ignore, I suppose.

Yeah, yeah, yeah.

And again I talk about this a bit but like information, there are a code is kind of, it's both business instruction if you want, when we're talking about like code for automation, it's both business process, it's information about how your business works and it's kind of, you know, commercial type information as well. So it, it has multiple different lines of exposure that might not have existed previously if you were just, you know, doing like manual business. And obviously the more that we automate, the more we go into that space, I think, you know, there's a huge conversation about AI everywhere across.

I was going to ask you that question. Yes, yeah, yeah, AI.

I, I personally don't like the word intelligence in AI because I don't really think it is, it's nothing like our intelligence anyway. It's really you, you wouldn't teach your child how to make a judgment purely on statistics, but extremely advanced statistics. And look, it's great stuff. Like I've again worked in the data space, done machine learning things in a regulatory space. It's, I mean it is a massive advance. So don't think that I'm saying it's not, but I think it almost, it's another actor in the system now and it's an actor that if we have to be really understanding, learning how to again put the same kind of quality assurances and controls around what it's able to do on its judgments and make sure that those things are not also as if they were a person inadvertently doing the wrong thing. They're just a person that can inadvertently do the wrong thing. Extremely Fast, Yeah. Doing the wrong thing if they're not doing the right thing.

Exactly, exactly. Yeah.

So we need to think about that and again, think of them, think of those AI parts of the process and those decisions in a, again a very systematic way and understand how to make sure that the right kind of against statistical controls for opportunity, if you want to call it that, are in place in those sorts of systems as well.

If you're looking into the future, let's say three or five years from today, where do you think insider threats and the management of it is going to be roughly?

Well, I hope that some of these systemic elements are something that does come to define a bit better how we do things. I hope more broadly. I think the field of business architecture is something that also is kind of growing and in some ways this is kind of using business architecture to determine inside of risk, right? Yeah, I think that. And the use of like the understanding of organizations in a structured and a structured data way as well, I think hopefully will evolve. I think there's no question that AI is also something that is, is growing in ways that we've kind of yet to fully see and realize just where that's going. But I think also at the time, same, same time, there is more thinking now about how to understand the risks in that space and to manage them. So I think that can only be positive and I also think thematic way and understand how to make sure that the right kind of against statistical controls for opportunity, if you want to call it that, are in place in those sorts of systems as well.

If you're looking into the future, let's say three or five years from today, where do you think insider threats, like.

One of the other elements here is really, you could look at it in a very negative way inside a risk thing. But I think also the other part of managing things in a systemic way is understanding the downside impacts of control.

Yeah, I mean you mentioned it quite a bit in the book. So. And I'm very glad because not many organizations really think about it and the management of it is going to be roughly.

Well, I hope, I hope that some of these systemic elements are something that does come to define a bit better.

They tend to think more around usability versus control, but not so much the impact.

And I think that the thing there, if we think about the future is we don't want insider risk management to become a hamper on innovation either. So correct being able to make informed decisions about what we control, what we allow to run its course, how we allow innovation to emerge and when we, when like we decide that we. It's exceeded our appetite. All of that sort of thing I think is. Is something that hopefully in these kinds of that maturing of organizational design will get embedded a bit more. The other thing that I've been thinking about and you would have seen in the final chapter is it sort of sets out a broad data model for how the systemic approach kind of fits together. I'm hoping at some point to have the time to work with people to turn that into an actual data model that can be used at an organizational level as well.

Yeah, no, that's great. So what do you hope readers of this book will take away?

Well, I hope. Yeah, I hope that they. They take away like that core premise of that insider risk is a really. It is a genuine threat to organizations. How we. We do things. I hope more broadly. I think the other. The field of business architecture is something that also is not just to you know, a part of the organization or a small issue that's to the side, but actually that it's something that contributes to risk at the whole of organization and objective level that having a systemic way of looking at those risks and deploying controls is a better way than is kind of growing. And in some ways this is kind of using business architecture to describe it and so side of risk. Right. Yeah, I think that. And the. The use of like the uninvesting finite resources into the organization.

Yeah.

That it's really also about protecting your people and assets rather than putting a hamper on the way that you do business. And deploying that in a nuanced way allows you to do both things. They're not exclusive. You can do both.

Yeah. Fantastic. So look, we come to the end of this discussion. Let me ask you this question. Is there something I should have asked you, but I haven't. Is there something that you'd like to elaborate more about the book that maybe the viewers will find it interesting or.

I think we didn't really touch very much on the beneficiaries element of the book as well.

No, we didn't.

I think that the other really interesting thing to understanding of organizations in a structured and think about in an insider threat context is the link with the outside world and the people that might be targeting structured data way as well. I think hopefully will evolve. I think your people, I think about it in a regulatory context a lot and one of them is this concept of tactical displacement. So when we're thinking about external controls, if we strengthen, there's no question that AI is also something that is growing in ways that we've kind of yet to fully see and in those external controls. And someone still has the intention to be able to get around them and they can no longer get around them from the outside. So if we think of, you know, places that I've worked, border control, if, if you can misdeclare something, get it into the country, then you don't need an insider. Right. As soon as we get better at that external control, what's, what's not there, well, then they still, if they still want to get things through, then they've got to target someone internally around. So. So when we're strengthening the outside controls, we need to, at the time, same, same time, think, is it going to shift the risk into the inside? And that's when we again need to be thinking about how do we protect our people in that.

Correct. Yeah, totally agree. I think these, these are saying that.

If the door is locked, realize just where that's going. But I think also at the same time there is more thinking now about.

How to understand there's no point in beating the dog. Find someone that can actually open the door. So there's more, more from what I'm seeing, like recruiting, like social media recruiting for people in certain positions, it's always, you know, easy to find someone. You know, the question is, would someone be prepared to divulge secrets if they got paid some sum of money and what is that sum of money? So we're human, so it's much easier to look at people than look at.

The risks in that space and to manage them. So I think that can only be positive.

And I also think controls, especially if you've got good perimeter controls or whatever. Yeah, totally agree.

Yeah. And I guess the message there is really, when you're thinking about strengthening other risk controls, you need to be thinking about what does that do to your insider threat? Does it change the character of it? And it's worth thinking about those two things together.

I totally agree. How do people, viewers get hold of this book? What's the best process for them to get hold of this book?

Well, it is available online, so it's Ratledge, who's the publisher on their website. You can write Routledge and my name and it comes up in search.

Okay.

It is also available on Amazon. Similar way, either title or. Or looking up my name will come or inside a threat in my name will come up. Like one of the. The other elements here is really excellent, excellent.

And look, if someone wants to reach out to you, Pierre Is there a way for them to do that?

Yep, I'm on LinkedIn and happy to have a conversation on. I'm pretty easy to find on LinkedIn because I don't think there's very many pskorich's out there. You could look at it in a very negative way there inside a risk sting. But I think also the other part of managing things in a systemic way is understanding the downside impacts of control.

Well, Pierre, look, it's been a pleasure having you on again. Very much enjoyed reading the book and I also very much enjoyed talking to you about the book. Thank you. And yeah, it's a pleasure.

Great, thanks so much.

Thank you everyone and see you next time. Yeah, I mean you mentioned it quite a bit in the book, so. And I'm very glad because not many organizations really think about it. They tend to think more around usability versus control, but not so much the impact. Yeah.

And I think that the thing there, if we think about the future, is we don't want insider risk management to become a hamper on innovation either.

So correct.

Being able to make informed decisions about what we control, what we allow to run its course, how we allow innovation to emerge and when we, when like we decide that we it's exceeded our appetite, all of that sort of thing I think is something that hopefully in these kinds of, that maturing of organizational dispositions, design will, you know, get embedded a bit more. Yeah, the other thing that I've been thinking about and you would have seen in the final chapter is it sort of sets out a broad data model for how the systemic approach kind of fits together. I'm hoping at some point to have the time to work with people to turn that into an actual data model that can be used at an organizational level as well.

Yeah, that's great. So what do you hope readers of this book will take away?

Well, I hope, yeah, I hope that they, they take away like that core premise of that insider risk is a really, it is a genuine threat to organizations. Not just to, you know, a part of the organization or a small issue that's to the side, but actually that it's something that contributes to risk at the whole of organization and objective level. That having a systemic way of looking at those risks and deploying controls is a better way of investing finite resources into the organization. And that it's really also about protecting your people and assets rather than putting a hamper on the way that you do business. Deploying that in a nuanced way allows you to do both things. They're not exclusive. You can do both.

Fantastic. So, look, we come to the end of this discussion. Let me ask you this question. Is there something I should have asked you, but I haven't? Is there something that you'd like to elaborate?