When Trust Becomes a Blind Spot

Welcome to the Global Insider Threat Awareness Month 2026. This year's focus is where trust meets risk. Trust is fundamental to how every organization operates, but every time we extend trust to people, partners, or relationships, we also create opportunity. And with that opportunity comes exposure. To explore this relationship, I'm delighted to be joined by César Ruiz, Principal Protective Security Advisor with Australian Ministry of— Australia, did I say Australian? New Zealand Ministry of Education, and a board member of New Zealand Institute of Intelligence Professionals. Cess has spent more than 15 years working across intelligence and security, including 7 years as counterintelligence analyst with New Zealand Defence Force and 2 years with the Combined Threat assessment group. For the past 2 years, he has also served on the board of the New Zealand Institute of Intelligence Professionals. So with that, Seth, welcome to GIDM, and apologies for the— if I mention about Australia, but you know, it's all good.

That's all right. No, we're very forgiving here in New Zealand. That's— it's great. It's great to be here.

Thank you, Seth. So before we get into the discussion, perhaps you could give us sort of a brief background, what has shaped your perspective on intelligence and security?

Sure. My first role in the security and the intelligence space was a vetting role. I had a vetting admin role for around about a year, and that really gave me insights into how the security clearance works for New Zealand and sort of opened my eyes to just how interesting and important the security sector is. I was eventually seconded into the Combined Threat Assessment Group, group as a threat assessor, so providing intelligence assessments around threats to New Zealanders, mostly overseas, but we also looked at domestic terrorism. And that was about the importance for me of really good, clear security threat reporting and flowing into advice, that the work we did flowed from classified intelligence through to national travel briefings at the unclassified level. Yep. I then spent 7 years doing counterintelligence for the Defence Force, providing personnel security advice to uniformed and civilian, um, staff, um, as a civilian myself, um, then moved, um, into an engagement role with MPI for a couple of years, came back and did some, um, intelligence work, and, um, I've moved back into, um, protective security, just really, um, missing that security work. So most of my— Awesome. Most of my intelligence, um, work has been through, um, the security lens one way or another, um, and, and that's what I guess brings me here today.

Fantastic. So with that, when does trust become an intelligence blind spot?

I guess trust is that tricky thing, you know, an organization absolutely relies on trust to function, and especially in a Western democratic country. So trust is assumed, it's part of the makeup. And the way I guess around that is if there aren't The blind spot appears if there aren't good procedures to identify where the assumptions and issues around trust are coming up. So if you don't have a mature intelligence model, if you don't have mature and experienced leaders making decisions on the basis of that intelligence, that's when that trust is a problem. There's nothing to course-correct away from just that default assumption that we have—

Yeah.

In Western countries around trust.

Do we, from your experience, do we stop questioning simply because they are trusted? You know, trusted relationship, trusted partner. Do we just make that assumption that, you know, we don't need to ask those questions?

I think we do. But what agencies generally do, in my experience, especially the security-related ones, is that you build in processes and requirements to help catch when those assumptions are taking place. So yes, yes, we trust them. providers of our kit, but then we have an audit function where we're logging where these devices are coming from, that we are restricting which countries can tender for our sensitive kit. So trust, I think, is fenced in by good procedure and good process.

Okay, okay. So if intelligence challenges a long-held organizational assumption, What usually wins, the intelligence or the assumptions?

That would, that would depend on the— again, I'd say on the maturity of your intelligence system.

Yes.

I think a good relationship between the intelligence provider and the decision maker will, will help more effectively challenge assumptions across the organization. I've personally spent a lot of time as part of effective teams where we've had a really good relationship with decision makers. And we were able to provide guidance around military platform acquisitions, around exercises, around how we do our diplomatic relationships with countries that are a little bit concerning at times. And our advice in the team was generally well accepted because—

Yeah.

you know, there was a pedigree of robust assessments and good advice. We weren't overcooking the risk, you know, overreacting to it. We were providing measured approaches. I was part of that same team when a change of leadership and management style undermined some of the relationships, and that led to an undermining of our ability to effectively influence, and that steered us away from you know, some effective risk management and set us away from our ability to challenge some of these assessments because we'd lost that credibility. So the relationship between an intelligence team and the decision maker is just absolutely vital in being able

to

overcome those issues.

Okay, so here's a sort of a sidebar type of question. What is more dangerous, not having enough intelligence or having intelligence that nobody's prepared to act on?

I think in the first response, I think they're both equally dangerous. You know, they leave you to a situation where you can't respond to a threat or a risk. In terms of once you're in that situation, I think it's worse to be in a situation where you don't have the intelligence, because to me that implies that your intelligence structures, your whole intelligence sphere is under-resourced or a bit broken and needs a huge investment. If, if no one's acting on the intelligence, then, you know, you've got a real problem. But it's kind of easy to circumvent that and to improve your acting on— that leaders are acting on your intelligence by relationship building, by changing the way you're presenting the intelligence, by getting to know your decision-makers so that you're able to have that, that impact more effectively. And the, the lead time from recognizing the problem and addressing it is a lot shorter when you're— sorry, it's a lot shorter to— just a phone call came up. Yeah, the lead time between addressing an issue of culture and taking up the intelligence is shorter than having to rebuild a capability from scratch, getting the investment, recruiting the staff, building the intelligence networks, and going from there. So I wouldn't want to be in either situation, but the second one is probably much more common, but also easy to— easier to address.

Yeah, which leads me to the next question, which is, you know, does trust make certain warnings, signs harder to see or simply harder to believe?

I think trust can make it hard to— I think, yeah, an organization that really heavily leans into leans into its trust, can make it hard to prioritize correctly, to realize the severity of an issue.

Yeah, yeah.

And, and to, to put the weighting on other issues that are involved in responding to a recommendation. So you might be recommending that this individual is put through a disciplinary process or removed from their role because there's some concerns. And then your decision-makers, your managers, are starting to think, well, actually, you know, what if there's a legal challenge? I don't have the time to deal with a legal issue. Is it really as bad as all that? I don't want to waste time. You know, what if, what if this whole process is challenged and it fails? Is it really worth it? So— Yes. I think trust can cloud the waters a little bit when it comes to that, that you're not used to making decisions because you're not seeing, you're not seeing the impact, you're not seeing the risks the same, especially in a comparatively low-risk environment like the Ministry of Education, you know, we don't have many examples of insider concerns. We, we have the occasional one that hits the media, um, but they're kind of narrow. Um, in a, um, in an agency where the, um, um, the issues might be a bit more controversial, or an agency where, um, where, um, national security is more involved, it might be a bit of an easier, um, a bit of an easier sell.

Yeah, yeah, yeah, yeah, yeah, that, that's, that's true. Interesting what you said. Can organizations generally understand it's insider exposure if it's intelligence sort of primarily looking from the outside? And I've got a second question to that, but I just wanted to hear your perspective first.

Yeah, sure. No, it definitely can't. You do need to be looking internally. But then the problem is it's very hard to look internally. You begin— you can undermine your internal, your organizational effectiveness if you're too heavy-handed in your internal, internal viewing, you know, we have privacy laws, we have other things built to protect people's freedom of expression, and we're carrying risk as an organization, as a country, as a society, to allow people to speak freely. And the risk is often in that security sphere. So that flows through into organizational security, that we have less legal possibility and less also cultural mandate to be be monitoring too closely inside.

Yeah. So the second part is, can organizations genuinely understand its insider exposure if the intelligence that is gathered has provided no evidence of, of, of an insider, for example? Because sometimes we tend as organizations to say, okay, given we haven't seen anything, so we must be safe. So I was just sort of curious from your perspective of the idea that some of the executives and management say, well, there's no evidence, so therefore there's no need for us to pursue a sort of a rigorous program.

So I think the response to that would depend a lot on your organization. But, you know, the first response would be, you know, we don't have the permission or the access to know, you know, we don't— we just don't know what we don't know. There's plenty of information gaps in our understanding of the organisation. We don't have good levels of reporting. And then I would be able to refer to examples from other Government departments. You know, we know that— Yeah, absolutely. —agencies with a similar profile are reporting a lot more insider concerns than we do. So it's more to do with— I'd make the assessment it's more to do with the internal circumstances of of our reporting rather than, um, you know, we're immune to them.

Yeah, interesting. Now, from your sort of looking from the outside into the executives' management, um, if, if a CEO asks its management, what don't we know about the people and the relationship that we trust most, what do you think Could be maybe the type of answers that management would then report back to the executives.

So I think management would be able to identify individuals who have a lot of responsibility, that they have important access, or they're managing, you know, vital programs, and there is no lifetime monitoring or support support providing to them, provided to them to help identify, you know, sort of insider vulnerabilities with regard to them. So when someone joins an organization, they're hopefully put through quite a robust recruitment process with, with referee checks and police checks and all that sort of thing. But for many staff members, that's the last time anyone looks into their—

Yeah, yeah, yeah.

Into what's happening in their lives. And most agencies don't have a culture where people are really active in reporting, hey, I've got this problem in my life, it might, you know, you'd want to know about it so that we can work together to manage it, you know, don't have that proactive culture. And then we don't, within the Ministry of Education, we have very few national security clearance holders. You know, that national security clearance process gives a robust way of checking in with people. It structures regular check-ins with them to make sure that issues in their lives are addressed. Yeah. So that sort of question from a CEO could lead to, you know, recognizing we have this vulnerability, we have this pool of people that we need to know more about, and we're in the process of developing a a way of monitoring them, encouraging them to report on issues, giving them briefings and check-ins, and doing it in a less formal way than a national security clearance, but giving us a bit of insight. And that is something that we're working through the motions of in response to our annual assessment.

Is visibility a critical component of that?

What do you mean by visibility?

Intelligence. So knowing more, so knowing more about what their employees are doing, or just the culture, the policies, whether they're following due policies or processes and so forth. So is it— could it be that they may not have the intelligence to understand the potential exposure to that sort of fundamental trust?

I think that employees and managers would both struggle in lots of cases to understand why an organization would reasonably be interested in difficult things in their lives.

And

that would take, you know, people can understand it when they have it explained to them from a national security perspective. And I think that if there was a process and some education around it, an agency would be able to communicate that effectively to a staff member, but it would be walking quite close to that line between, you know, having a personal life and having, you know—

Yes.

Privacy and having issues that you're addressing with, and seeing the connection to your work life. Yes. And it would be, you know, recognizing that your role is a unique role with unique access and responsibilities and, you know, financial powers and, you know, the sort of capabilities that you are engaged with day to day, you know, It would need to take a pretty clear case from the, from the agency to make them buy into that sort of more invasive process.

So from your perspective, can too much trust actually make an organization less intelligent?

I wouldn't say it would make it— wouldn't make it less intelligent. I'd characterize it as potentially more vulnerable. I think that, that the vast majority of staff wouldn't be, wouldn't be interacting with an insider risk process with any, you know, yeah, I'm sort of struggling with this question a little bit.

No, let me ask it slightly different.

Yeah, sure.

What happens when we become The relationship between our colleagues, our bosses, the processes— does it come to a stage where, okay, the trust is embedded there, but would we challenge— you know, maybe we would be reluctant to challenge our peers, maybe we would be reluctant to challenge established relationship or even test assumptions. So I suppose that does trust itself begin to, if you want to call it, restrict what the organization is capable of seeing?

Sure, yeah, I'm not sure I would necessarily use the word trust around that, and I might be just, you know, over-focusing on a common definition of trust, but certainly an internal culture can hold people back from challenging those assumptions. And we have cultural tendencies where the first person to speak up, you know, they'll often carry the day in an argument. And that isn't so much about trust; it's more about, I guess, cultural patterns and mores. But perhaps an organization that really fosters speaking up, that has a culture around, you know, you can trust me, I will give you the space, you know, I will encourage you to challenge, you know, I don't want to hear groupthink. a culture that really wants to push freedom and encourage open discussion, that, that provides a safe space for challenging, you know, the first statement or an assumption.

Yeah.

You know, that, that will, that will open up to less assumptions being baked in, more challenging of the higher-status people in the team, that sort of thing. You know, certainly, you can, you can be held back by By our culture and by, you know, overweighting particular individuals. Yes, the loud ones, the more experienced ones, that sort of thing.

Which leads me to the next question. We often talk about connecting the dots after sort of like a data breach or cyber breach. Why are those same dots so difficult to connect before something happens?

This is a, this is a confronting question, isn't it? When, when, when something happens—

It's a really important

question. Yeah, you're right. Yeah. And more than that, depending on some, on some, some events.

Yes.

I think this is where trust does come into play, that we, we rely on other people to do their job right. So if something's missed, then, you know, you can go back through after the fact and work out what someone's missed. But We don't want those awkward conversations where we're challenging someone on the basis of the quality of their work or, or their assumptions. We don't want to take on extra workload to, you know, double-check people's work. We don't want to invest the time, and when we're all really tight for time, we're often understaffed, to put it through a robust review process. Yeah. So I think trust comes into that sort of situation when, you know, we do by trust, by default, trust our colleagues to do their work. But it is also, you know, painful to reevaluate assumptions that have crept in that we haven't picked up through whatever process we've got. Yeah. And often an organization has a lot of inertia that, you know, keeps things going in the same way and makes it hard to step outside the box. I know that before the March attacks in Christchurch in 2019. A few months before that, there was a conversation in my team, and it made its way into some assessments about the risk from right-wing extremists. And we'd not seen any reporting that covered that in any way. And it was, you know, someone asked— raised the question about right-wing groups, and then they asked the same question 6 months after the March attacks, you know, about left-wing wing groups. And it was easy to, you know, easy to consider the left-wing groups when we'd had our assumptions around the right-wing group, right-wing individuals, you know, challenged so brutally following the attack. So we stay in that groove, we match other people's reporting because—

Yes.

It's a lot easier not to. And there's not always the evidence to— the bulk of evidence does often line up with our assumptions. So it takes a bit of training and it takes a questioning culture and it takes really robust analytical standards to give us a hope of stepping outside some of those assumptions and trails.

So this leads me to the next question. Are we collecting more intelligence than ever before, but is it possible that we understand less? Is it because of resources? Is it the ease of use of collecting information? What do you think?

I think as our information systems have gone online, we've definitely got a lot more data. I think that You know, when I joined, when I moved to Wellington and joined that vetting team that I first mentioned earlier on, we were starting the process of digitizing our vetting paperwork. You know, new forms would come in, they were scanned and OCR'd automatically and put through an automatic system. But I was brought in to help address, like, 3 walls in this large room that were— Yeah. Floor to ceiling in paper forms that had come in and had not been entered into the system. So all of that happens online now, you know, that there was a huge spike in volumes of data. The amount of information we're getting is increasing, but, you know, it's not— I don't think it's going up as fast as it was, say, 10, 15 years ago. But what we, what we're not doing— there's way more information than we can easily access, I think, now. That is a problem. And we haven't yet developed the best use of AI tools to extract that.

Yes.

So we are definitely drowning in data. And I think our adoption of AI is weighted towards finding ways to replace staff rather than finding ways to make our analysts, our vetters, our security professionals, our intelligence professionals do their job better. So I think AI provides an extraordinary opportunity to interrogate vast bodies of data that we are not able to get to. We are certainly overwhelmed with how much it is. But there is, I think there is an opportunity for us to exploit these tools more and more. And I'd like to think that, you know, we'll learn a few really good lessons over the next couple of years and sort of reshape our focus to— Yeah, yeah, yeah. to tools that enable an analyst rather than replace them, perhaps.

Yeah, with the same question, are you also seeing a challenge in terms of how you collect the information? Because no longer are organizations bound in, in a building, you know, you've got people working from home, you've got trusted business relationships, and so forth. How do you Do you have that visibility still?

I think it is. It always has been difficult, but we are more distributed and there's less interaction with people. You can't beat human interaction to get buy-in, to encourage people to share information with you. It is possible to make connections with people and encourage them to supply the information, you know, you need, the reporting that we need around security incidents through a remote environment. It's just a little bit more difficult. channel, but it's nowhere near as effective as influencing someone that you've spent time with. You've read their body language, you've shaken their hand, you've given them a hug, whatever it takes. You know, I think the word— the post-COVID world, everyone is very used to working digitally. And the financial world that we're working in, with all the financial constraints the governments are working under, you know, there's a lot more pressure to do things remotely. But it does, it does mean it is harder to draw that information— Yeah. And to convince people at the coalface that they really need to take a risk that they'll be less able to do their work, or it'll feel like they're less able to do their work, and report to us a security concern, report to us something about one of their colleagues that needs to be, you know, looked into. Definitely, the distributed world that we're looking at is— I think it's a matter of influence rather than increased complexity. That's the bigger problem there.

So if you had to look in the next 5 years, where is intelligence heading to from your perspective?

That's a good question. I think I can't predict how AI is going to shape our roles, but I would like to think that we have— that intelligence analysts have access to some really people-friendly tools that can let us reach in to exploit, you know, reach in and evaluate sources of data that we can make it easy for ourselves to access it. But we can also use those same tools to make it really easy to get reports from widely, those widely distributed communities that we're interacting with. You know, that's what I'd like to think. I, I think in New Zealand in 5 years' time, as a representative of NZIP, I'd like to think that we're able to grow the connections among intelligence professionals, to identify more intelligence users, to shape our leaders to understand how to use intelligence and call for it more. And I'd like to think that, you know, that we are more often using those wonderful analytical techniques that oftentimes stops us from doing, that AI can maybe give us some of that time back to push off some of those mind-draining tasks.

That's the idea. Yes, that's the idea. If you could leave the board and the executives with one piece of advice during the Global Insider Threat Awareness Month, what would it be?

I would like them to understand that looking into insider threat, to being prepared to address insider threats, is not a matter of distrusting your staff. Yes. But it is understanding the pressures that everyone is under and putting things in place to address vulnerabilities rather than to go on a witch hunt when people do something wrong. I'd like people to— I'd like CISOs chief executives to understand that there's a way that everyone can win. People can get the support they need, and the organization will run more smoothly, more safely, with less breaches, and individuals will maintain their, their work without the consequences of a terrible decision because they're under stress, for example. So that's what I'd like them to take away.

Okay, Seth, look, much appreciated for your time. and the answers. I really learned a great deal from that, and I really appreciate it.

Great. Well, I'm really happy to be here, and thanks for the chance to talk.

Thank you, Seth. Have a good one.

Cheers.