Insider risk — Security starts with you
February 3, 2026 - Defence Stories
Insider risk isn’t always the work of a spy. Sometimes it can stem from a simple mistake, a lapse in judgement, or a trusted individual misusing access. Whether from an employee, a contractor, or a former member, insider actions (malicious or accidental) can have a costly impact on DND/CAF.
But what does this mean exactly?
To help Defence Team members recognize these risks, our infographic highlights how insider risk can emerge and how everyday habits: awareness, secure behaviour, and timely reporting, can protect information, people, operations, and assets. The accompanying video demonstrates how routine interactions, both online and while travelling, can quickly turn into opportunities for information collection.
Video / February 03, 2026
Transcript
A CAF member receives a friendly message online from someone claiming to be a defence blogger.
The chat starts casually… until questions shift to training, deployments, and equipment.
The account seems normal, but something feels off.
It’s actually a foreign intelligence collector…
The member ends the conversation and reports it…
A Defence Team member is travelling abroad.
In a hotel lobby, they chat with a friendly traveller interested in Canada’s military.
Simple questions turn into specific ones about operations…
The member shares more than they should—until the traveller suddenly leaves.
Realizing the mistake, they report it.
Even small pieces of information, shared casually, can be collected and exploited.
When something feels off: report it.
Security starts with you.
A message to all supervisors
Help mitigate insider risks:
- Verify clearances and enforce need-to-know access
- Report concerns
- Ensure security, Operational security (OPSEC) & cyber awareness training
- Maintain and communicate unit Security Orders
- Appoint a:
- Information Systems Security Officer (ISSO)
- Unit Security Supervisor (USS)
Staying alert and speaking up when something feels off strengthens our security culture.
For more information on a variety of security topics, visit the Security Awareness Toolkit, available through the Director General Defence Security (DGDS) intranet page.
Infographic - Text version
Insider risk
Are some of our security threats from within?
Threats aren’t limited to spies or cyber criminals, it can come from anyone that is or has been employed within the DND/CAF: an employee, a CAF member, contractor, or student — anyone who has access to sensitive information, assets, people, facilities, who can cause harm to the organization.
The intent can be malicious, careless, or even unknowing… but the damage is the same.
It affects our people
Security risks can:
- Compromise classified information or IT systems
- Jeopardize operations and personnel safety
- Damage Canada’s international reputation and partnerships
- Cause financial and operational loss
Types of Insider Risks
Intentional or unintentional
- Careless
- EX: Leaving systems unlocked, clicking phishing links, oversharing info in public, poor Operational Security (OPSEC).
- Radicalized/Ideological
- EX: Promoting extremist views or group affiliations conflicting with DND/CAF values.
- Compromised
- EX: Exploited by a third party: Access hijacked via malware, phishing, or coercion.
- Disgruntled Former Personnel
- EX: Using residual access or knowledge for harm.
- Malicious
- EX: Selling or publicly leaking classified info for revenge, sabotage, espionage.
- Criminal
- EX: Engaging in violence, fraud, theft of DND/CAF property.
Behavioural Indicators
Report changes and security concerns:
- Significant changes in circumstances or behaviour (drug or alcohol misuse /unexplained frequent absences, unexplained wealth or debt)
- Divided loyalties/obligations to foreign family members
- Security issues (pattern of security violations, wilful non-compliance, disregarding policy)
- Unauthorized searching, requests, access, retention of classified or sensitive information
- Unexplained or unreported security incidents or interactions with known security threats
- Expressing ongoing disgruntlement with their unit or employer
- Unexplained or unusual work during unsupervised hours
- Unexplained or unreported foreign travel/foreign contact (when reporting is required)
- Secretive workplace behaviour (hiding documents, blanking computer screen, avoiding colleagues)
- Atypical online activity or profile (dark web use, foreign contacts)
- Criminal activity or involvement with law enforcement (new/previously concealed)
Remember to
- Protect DND/CAF info, assets & systems
- Complete security training
- Follow OPSEC rules (don’t hold secure doors, verify unknowns)
- File a Notice of Intent to Travel (NOIT) before trips
- Always apply the Need-to-Know principle when sharing/discussing sensitive information in the workplace
Report Insider Concerns
Official channels:
- Your Chain of Command/Supervisor
- Unit Security Supervisor (USS)
- Information Systems Security Officer (ISSO)
- Submit a Change of Circumstance form (DND 4151)
- CF National Counter-Intelligence Unit (CFNCIU) cfnciuops-opsuncifc@forces.gc.ca
- DGDS Administrative Investigation Bureau (AIB) rod-rdd@forces.gc.ca
- CF Military Police (CFMP)
Supervisors at all levels
Help mitigate insider risk!
