New Zealand's Security Threat Environment 2026

More insiders in organisations are causing harm to their organisations and to our national security through actions that are either deliberate, influenced by others or unwitting.

Both public and private sector organisations in New Zealand are vulnerable to harm from insider threat activity such as unauthorised disclosure of sensitive information, theft of intellectual property, process corruption, compromise or misuse of assets, or sabotage.

Foreign states are increasingly targeting insiders for espionage opportunities but sometimes an insider might be motivated by personal reasons or because they have been incentivised or coerced by another third-party.

An “insider” is considered anyone who has, or previously had, access to knowledge of an organisation’s resources. Knowledge may include information about people, processes, information, technology, and facilities that is not accessible to the general public. Very few employees will become an insider threat, but it is an important risk to manage due to the harm that can be caused.

Over the previous 12 months, we have seen instances of deliberate, influenced, and unwitting insider acts.

Deliberate insiders purposely cause harm to their organisation for a variety of reasons. They may have developed a grievance, or the job has not met their expectations. Sometimes the motivation is simply for personal gain.

In many cases, the insider act follows a period where they have been under pressure or have been exhibiting out-of-character behaviour.

Influenced insiders may be coerced or incentivised to cause harm. They might face external pressure from foreign states or criminal entities, or from individuals who wish to harm the New Zealand government or our national security.

NZSIS has seen examples where an insider has been incentivised with a financial reward or the promise of an increase in status.

Vulnerable people can be manipulated by skilled actors to misuse their privileged access as an employee to support a criminal group or foreign state. Such deception can have a wide spectrum of serious consequences, including compromising our national security, degrading a system or capability, eroding trust in New Zealand’s institutions, economic damage, and, in some cases, physical destruction or injury.

Unwitting insiders cause harm through negligence, poor practices or naivety. Even though there is no intent to cause harm, the consequences of their actions can be widespread and long-lasting.

Generally, no single factor can lead an insider to undertake an insider threat act. Instead, a series of events and pressures can make an insider become more vulnerable.

Examples NZSIS has observed include financial stress, challenges at work, concern about international conflict and global instability, or mental health challenges.

Motivations for undertaking an insider threat act are complex and varied, and can include a combination of disgruntlement, grievance, ambition, financial motivation, complacency, or naivety.

If you notice any of these behaviours or activities, let us know.