What are the strategies for mitigating the risk of insider threat from disillusioned employees?

Employees who undermine or sell out their organisation don’t necessarily start out as malicious threats. They can also be long-standing and loyal employees who, because of large organisational change like a restructuring or alterations to their pensions, have become disillusioned or angry with their employer.

Recent research on individual employee responses to organisational change identified seven different emotional and behavioural types. Based on our research, we have built on these seven categories to suggest ways to positively influence individuals in order to prevent or mitigate the likelihood of insider threat during large scale organisational change.


These employees are receptive to the need for change. There is a fit between their personal goals and those of the organisation.

Employees are proactive in identifying what might be improved and done differently to support change and are likely to co-operate with leaders and managers to make the transitions required.

They are therefore engaged and active participants in change processes, offering their ideas and suggestions on how to adapt and meet the organisation’s new needs.

These individuals are unlikely to be either active insider threats, like those leaking data or undertaking other malicious behaviour, or passive insider threats, such as those employees withdrawing effort or not reporting others’ negative behaviour.

Communication and engagement strategy

Managers should continue dialogue with employees at all levels to allow these individuals to feel involved in the changes and updated on further developments.

They should talk to employees to check they are not just going through the motions and are anticipating issues that might cause subsequent conflict or challenge.

These employees could be appointed change champions where they lead employee forums on change and feedback concerns to management from across the other six groups of individuals outlined below.

Watchful followers

Positively Influencing Individuals During Organisational Change watchersThis type of team member is alert to and wary about change. In the past, there is likely to have been a close synergy between their personal and the organisation’s goals, but now they sense things might be starting to diverge.

Failure by leaders to acknowledge that a transition has started may sow the seeds of reduced trust and create more entrenched vigilance among this group.

This group is not likely to form an active threat but could be a passive threat in terms of withdrawing further effort and investment in their role during a time of uncertainty.

This might be the first stage in a progression towards insider threat and so active steps are required to re-engage with these previously engaged employees.

Communication and engagement strategy

Enhance the resilience of those in this category by letting them process their emotions about change by actively listening to their concerns.

They need time to talk through their issues and support to manage their emotions, which are likely to include surprise and shock, and therefore also watchfulness.

They need support to help them regain their sense of control. Build on their previous positive experiences of transition(s), and provide clear explanations as to the underlying reasons why change is now necessary. This interaction needs to be genuine to avoid trust declining any further towards the organisation and its leaders.

Ensure such exchanges are positive and keep open the communication channels with them. Ensure those in this group are kept aware of new developments and actively involved if things progress in ways that are different from expectations.

Change the tops

This type of team member perceives that the source of change is due to unwelcome transition at the top, with newcomers imposing a change that appears, to them, to be unnecessary in the organisation.

Those in this category are concerned with a discrepancy between the past and any new organisational direction. The emergent diversion between their own goals and those of the organisation is becoming apparent.

This unexpected loss of synergy creates a perceived loss of control that they attribute to the new leader’s lack of knowledge and insight about the organisation. Insider threat can arise within this group through active retaliation against new 'problem' leaders and involve rebellion that is perceived as morally justified against leaders who are seen to either lack integrity or competence.

Passive threat activity could also emerge with those in this group feeling their concerns are unheeded by top management, and so they will choose to remain silent and not speak up about other things, such as other co-workers’ counterproductive work behaviour.

Communication and engagement strategy

Emphasis needs to be directed towards communicating the case for the change, but also to try and make a link with what endures from the past. New top and local leaders should ensure that they are available to meet staff and hear their concerns.

From this interaction, it is helpful to try and discern what it is about the new direction that is seen as threatening. Attention must be devoted to trying to break down any emergence of a ‘them’ (new leaders) and ‘us’ (those remaining in the organisation) dichotomy.

Further, in building their credibility, new leaders need to ensure that their words and actions are credible and engender the trust of staff.

These individuals could be included as critical friends on management committees for the organisational change; this would increase the transparency around the change process and the new leaders, adding insight and potentially gaining their subsequent buy-in and participation for the new direction.

Concerned loyalists

Positively Influencing Individuals During Organisational Change Concerned loyalistsThis type perceives a disconnect between different parts of the organisation, which stems from different perceptions about what needs to change and why. They see a fit between some parts of the organisation in terms of personal goals and organisation goals, but this is not universal with a perceived lack of alignment between some departments, groups or units.

This may be symptomatic of the different speeds of change in the organisation, or through different ways of working, or different requirements of customers, and so on. There is little risk of active insider threat here as this group is raising their concern.

However, passive risk can arise if these employees start to feel that their concerns are not being listened to meaning they, therefore, choose to withdraw, ignore and not report others’ counterproductive work behaviour.

Communication and engagement strategy

Time needs to be devoted to listening and working out whether this category is voicing a genuine difference and concern which offers important insights for the organisation, or whether this is about shifts in power dynamics. It may be important to use third parties to defuse and avoid partisanship in any new direction agreed.

Try and emphasise the greater good of the organisation as a whole and why all departments matter in the transition. Individuals in this group could form the basis of inter-departmental taskforces/forums on organisational change. This might be an important opportunity to build insight and raise awareness of differences between two divergent areas.

If handled positively, it can be a means of creating dialogue and resolving conflict around newly agreed objectives. If dismissed or diverted, it has the potential to sow future seeds of discontent between this department and another, but also towards leadership.

Identity Shifters

Positively Influencing Individuals During Organisational Change identity shiftersThis category arises from a disconnect between an individual’s past work identity and goals and the new organisational requirements and objectives.

This difference may have been occurring over a long period of time and be related to generational differences, such as from different training given to a particular profession which has now been superseded by something else. This is unlikely to be a single individual, rather a view shared amongst similar others either within or across departments.

These individuals can create a heightened risk of insider threat, either through their withdrawal and passive resistance to the new direction or from efforts to actively sabotage the change.

This risk can arise through their moral disengagement, characterised by cynicism, frustration, fear or anger towards the required change. If these individuals are morally disengaged they may fail to see their retaliatory actions as harming the organisation and its stakeholders; they need support to help them to recognise the unintended consequences of their actions.

Communication and engagement strategy

Attention needs to be paid to identifying and emphasising the overarching elements of the job/ profession that are enduring, to underscore what is being changed and why these new requirements are necessary. Importantly these should be communicated in terms of how changes enhance the role, rather than detract from it.

It is critical that this group’s contributions and the value they bring to the organisation are recognised. This can be done through personal and specific feedback from leaders. Given the level of experience of this group, it is likely to be important to listen to the concerns about what is being endangered for them.

Negative reactions may be related to a perceived loss of status or resources that make their roles more difficult to do. Identify and focus efforts on influencers in this sub-group who can be pivotal in gaining support for the change.

If after evaluation, this group are found to be accepting of and operating in line with the updated changes, they should be encouraged to support the training and mentoring of other staff. Such a strategy would send an important signal of respect and appreciation for their skills and insights and help to motivate the ongoing development of these individuals’ skills.

Angry Distruster

Positively Influencing Individuals During Organisational Change angry distrustersThis category arises from a change that thwarts an important personal goal. This is likely to have arisen over time and may be related to identify-shift issues. It may also stem from unrealistic expectations that have not been well-managed by earlier line managers and which have now reached a tipping point.

As a result, they are likely to feel morally justified in undertaking actions that recover what they perceive is 'owed' to them. This group presents the highest risk of active insider threat, and such individuals are also vulnerable to being exploited by malicious external/internal actors.

Further, the long-term stress implications of this state can result in them becoming more of a risk than even they intended.

Critically, they are already likely to be isolated from their workgroup, which can seriously impede efforts to discern the real level of threat they pose. They distrust those in authority whom they are likely to regard as responsible for squashing or sabotaging their cherished plans.

Communication and engagement strategy

It is important to sensitively identify the underlying source and history of the angry distruster’s issues. This state is a demanding and depleting place for anyone to be in for any length of time; it takes effort to stay angry.

Once leaders have ascertained the ‘problem’ they can discern whether it is possible to achieve some or all of their goals, or whether a better route is to apologise for past or future (perceived) injustices.

Be aware that any leader, due to their position as an authority figure, is likely to be in a difficult position to help and instead could exacerbate issues. Care and sensitivity is required to avoid creating a wider angry distruster group through the perceived unfair treatment of colleagues.

New leaders may not be tainted in the same way as those with a long history. Avoid creating any kind of scapegoat or martyr but equally, ensure that those who pose a risk are not allowed to remain unchallenged. If this situation has been going on for some time co-workers may have been alienated and also feel resentful of the time such individuals absorb from leaders.

Identify those who still have a constructive dialogue with the individual. It is important to try to recognise what adjustments could be made to support this group, but also the limitations if their expectations are unreasonable. This may make their retention difficult and it might be better for all for them to exit the team or the organisation.

Key here is that this group’s treatment can send important signals to others about how the organisation cares for and respects its staff.


Positively Influencing Individuals During Organisational Change apatheticThis category of employee is likely to contain long-serving and previously loyal individuals. They now see no synergy between their personal goals and those of the organisation. They may have been angry distrusters in the past.

They may perceive there is simply no point in changing, but still want to try and remain in the organisation in order to access their pension, for example. It is important to distinguish between those who represent an insider threat through their passive withdrawal activity, from those who are actually still angry and so pose a more active risk as outlined in the angry distruster category.

This group is likely to use withdrawal and escape coping to avoid engaging with the changes occurring around them. Their disengagement will be noted by others and can spread and become the norm if left unchallenged.

Communication and engagement strategy

It is important, as with other types, to ascertain the underlying source and history of this group’s issues. It is crucial to recognise those who used to be engaged and discern whether work or other external matters are core to their disengagement; they may have personal issues that are causing them to have to disconnect.

Identify any new organisational goals that incorporate things that have in the past been important to them. They may have significant organisational knowledge and experience that will be important for the organisation to retain and to transfer on to others in the team.

Ensure any effort at change is recognised and praised to help these individuals re-engage, but also monitor their behaviour to ensure they are not undertaking counterproductive work behaviour. Emphasise the risk to everyone from those who are not following the correct procedures or rules.

The tarnishing of an otherwise impeccable legacy is a lever that might be important in personally re-engaging this group. It might be productive to encourage these individuals to form part of small team-level taskforces on organisational change.

Read more