The Human Perimeter: The Insider Threat You’re Missing

Featuring insights from Aran Dharmeratnam, protective intelligence and risk consultant.

Aran Dharmeratnam doesn’t come from a SOC desk; he doesn’t think in blinking SIEM alerts on 24/7 screens or CVEs and patches. He’s spent his career helping organisations, family offices, and high-profile figures prepare for hybrid threat scenarios. He also trains in and teaches self-protection and unconventional tactics. When he talks about insider threats, he talks like someone who hasn’t just modelled how the other side operates, but seen it on the ground.

What follows is a structured extraction from a wide-ranging conversation on insider threats. It covers how a security leader should think about the human layer, and the resource and governance decisions that follow.

The Insider Reframed

The standard definition of an insider threat is rather shallow: a person with legitimate access who misuses it. Dharmeratnam’s framing fleshes this out: ‘They are dangerous in that they not only have access to certain information and data but also access to resources. The most powerful resource they have access to is the human one.’

With this, he shifts the question from “what data did they exfiltrate?” to “what relationships did they compromise?” An insider who turns a colleague, a vendor, or an access point creates a breach that a network perimeter may not necessarily flag. In 2025, members of the threat group Scattered Spider called a third-party help desk at Marks & Spencer. A password reset led to a ransomware attack that cost millions in lost profit.

‘Unlike the external cyber hacker they don’t need to negotiate shields and barriers from a distance.’

The insider doesn’t breach the perimeter; they are the perimeter. Yet the human layer remains underweighted in threat assessment, and that’s where privilege creep and social engineering live.

Reading the Human Layer

‘On the incident timeline, behavioural indicators or markers can show the pre-action phase that leads to the incident occurring.’ That means there is a window, potentially days or weeks, where a human observer could have flagged an emerging risk before a log entry or anomaly score made noise. The key question is whether the organisation has trained anyone to look for that window, and this is where Dharmeratnam’s expertise lies: the nuances of human behaviour and situational awareness. He advises against ignoring instincts. ‘I would say changes in behaviour that distinctly trigger one’s awareness mechanism. That ‘something doesn’t feel right’ feeling is part of that in-built intuitive capacity that most human beings have.’

In one case he describes, a relative of the targeted party was used as the access point in an operation. They believed they were helping. For an organisation, the lesson is that trust isn’t verification. A relationship, no matter how close, is not control.

What to Watch

In practice, this advice can be summarised in a small set of observable changes. A cluster of indicators that, in combination, likely warrant closer assessment:

• Vocalised grievances or expressed agitation
• Hyper-alertness
• Defensiveness or a sudden shift in communication style
• Stress indicators (with the caveat that often these can reflect personal issues rather than the threat activity)
• An exaggerated helpfulness or cooperativeness that doesn’t match the person’s baseline

The last one is counterintuitive. Assuming a threat actor looks threatening is a blind spot, because the most dangerous insider may suddenly seem more trustworthy.

Dharmeratnam calls this the yin and yang of signals. A typically lively person who suddenly becomes withdrawn; a typically reserved person who becomes the most helpful, open, and generous person in the room. Both changes warrant a second, and even a third, look.

Notes of Caution

Dharmeratnam cautions against reading too much into a single indicator. ‘When there is more than one indicator or when a pattern starts to form, then this should be treated as significant. The investigation procedure must be handled carefully from a legal perspective and with discretion applied.’ The observer’s job is to note, not to conclude. Consider Stanislav Petrov, who in 1983, despite the Soviet early-warning system reporting American missiles inbound, called it a false alarm without corroboration. Petrov averted nuclear war with his calm thinking, and while the stakes may be far lower for businesses, it’s a prime example of not reading too much into a single indicator.

The Vulnerability Map

‘Like foreign intelligence agents trying to recruit local assets: the external party will usually be trained or instinctively know…how to spot hooks, gaps and vulnerabilities. They will know what to exploit.’

The vulnerability map Dharmeratnam describes is less about technical access and far more about the psychological attack surface.

• A vice, desire, ambition, or egotistical flaw
• Naivety or lack of discernment
• Isolation or lack of purpose
• Financial pressure
• Openly demonstrated grievance against employer or organisation.
• Poor operational security in personal communications
• Susceptibility to duress, aggression, or subtle psychological pressure

The implication is uncomfortable: the person most at risk of recruitment is often the person struggling, not the malicious person, suggesting insider threat prevention is partly a wellbeing issue. As Dharmeratnam highlights, the most recruitable employee is the one in crisis, and that the organisation’s response to that crisis is the control. This means that if your EAP is a bolted-on afterthought, it becomes a gap in your threat model.

The Honey Trap Trope

The honey trap trope is common in espionage fiction, Dharmeratnam points out that it usually features a seductive state asset, like the Red Swallows deployed by Russian Intelligence, lowering a target’s guard with charm and the allure of sex. While this depiction can be accurate, he pushes back on the one-dimensional image: in reality, most exploitation vectors are far less glamorous. ‘The point to consider is that the honey trap can themselves be the lead or sole exploiter working on opportunist instincts or with a more methodical agenda.’ A relative pressured into providing access through emotional manipulation. A partner using financial urgency as leverage. A contact who feigns affection before pivoting to demands. Any initial charm and smooth-talking social engineering is ‘soon replaced by vindictive behaviour and ruthless demands. The victim doesn’t know who to turn to. This is where having access to those in protective intelligence and reputation safeguarding can be incredibly helpful.’

The mechanism he describes can now run through a cloned voice, making detection even harder. AI voice impersonations mean hesitations in a voice, a word, perhaps the last human tell, are gone. For an organisation, that verification point becomes far more urgent.

Predictive Templates

‘A template can be a proven, tested, highly effective entity. But the fact that is it now proven and established means it is predictable – at least over-exposed to perimeter testing. And so by default its success becomes its vulnerability.’

Dharmeratnam draws the analogy from Brazilian Jiu-Jitsu, a game of counter to counter. A technique once wildly successful for its originators becomes something to study and use against them.

‘Templates become puzzles that threat actors desire to solve.’

A known framework becomes an expected baseline an adversary can design around, and a template’s defensive value decays as its visibility increases. Like the physical body, security posture improves through rigorous testing in ways the adversary hasn’t seen.

Applying the same logic to training, he draws on martial arts to explain how to evolve to meet a changing threat landscape. ‘People can lose their edge, and sometimes they need to see the threats from different perspectives. Think about how even a seasoned fighter continually hones their craft, adds new tactics to their repertoire, and works with different coaches and sparring partners. We must apply this to organisational resilience now. Bring in different experts with wide-ranging experience.’

Five Things for the Security Leader

1. Don’t get comfortable. Threat actors often breach in decisive, brazen ways. Being ‘ahead of the game’ erodes quickly.
2. Pressure-test regularly. Regularly challenge defensive assumptions, as a combat sports athlete challenges their technique.
3. Account for humanness. A tired operator may make the same errors as a compromised one; not everything is malicious.
4. Study the psychological layer. Technical controls are necessary but not sufficient. Understanding how someone is manipulated lets you design controls that address the mechanism, not the symptom.
5. Build trained intuition. As Dharmeratnam illustrates, ‘Learn to build your intuition; it will help you perceive or at least be astute to other lines of digital or human sabotage. It takes training but can be extremely powerful.’

A Note on Culture

‘Organisations NEED to create a working culture where there are ample opportunities to get to know staff better.’

An employee who is known by name, context and their normal patterns becomes harder to recruit and easier to flag when something shifts. The challenge is achieving this without creating an atmosphere of suspicion. Dharmeratnam suggests the two are not opposites; a culture of mutual awareness is not paranoia. The difference, he says, is whether the observation is done from ‘a calm grounded state’ or from fear.

At its core, this is not an IT problem; it’s a leadership problem. The CISO who can walk into a meeting and explain why getting to know your teammates is a security issue, not a cultural one, is doing something technical tools cannot.

Notably, the same awareness that protects also serves as a blueprint. Training that teaches an employee to recognise threat indicators also teaches a threat actor how not to trigger them, and the more specific the programme, the more useful it becomes to the person it’s designed to stop. Dharmeratnam cautions that the organisation must manage that balance deliberately, not by withholding information, but by varying it, rotating it, and keeping it from becoming a fixed manual.

---

---