New Zealand Security Threats in the Workplace

Statement by the Director-General New Zealand Security Intelligence Service This statement relates to security issues in the New Zealand context. It reinforces the concerns raised by partner agencies in Australia and strategic security risk management consultancies such as Harris Security Management. One important issue typically missed by executives relates to the risk of threats and dynamics of the broader security environment reaching into and gaining hold within organisations across the spectrums of government, commercial, education, arts and not-for-profit workplaces. Social cohesion as an empowering factor in developing and sustaining positive corporate culture is seriously challenged when political activism occurs in the workplace and in some instances, this includes intimidation of colleagues. This is not a theory; it is for many organisations ‘the elephant in the room’. We know this from our work with clients. When political activism in the workplace occurs, there are consequences for example: ·     loss of good personnel escaping to ‘safer’ organisations ·     diminished attractiveness to potential employees (the ‘word’ gets around) ·     difficult relationship management with external stakeholders ·     loss of trust, innovation, collaboration, commitment and performance ·     loss of investment in personnel development ·     reduction of safety and security standards ·     loss of corporate resilience ·     increase in sick leave ·     elevation of the risk of psychosocial claims. Organisations need to be strategic, transparent and honest to identify and effectively manage intimidation to conform with the agenda of internal political activists and not let it become engrained. Failure to do so will result in a toxic work environment. Delay in facing this unhealthy situation is not an option. Determined leadership at the top is absolutely required for corporate hygiene. If you have concerns regarding these issues for your organisation, supply chain or 3rd party management services and want strategic clarity and solutions, please contact us. Read the statement: https://lnkd.in/g3n2KXpx Please follow us on LinkedIn - https://lnkd.in/etGU_9pC Harris Security Management – Trusted, expert and independent security risk management consultants since 1983. www.harris.com.au Declaration: We appreciate and benefit from AI. However, we do not use AI to generate our blogs, posts, reports or specifications. We believe in professional curiosity and integrity, human creativity and the protection of intellectual property. Proud Corporate Partner with the Protective Security Network. © Harris Security Management, March 2026. #humanresourcemanagement #workplacerelations #psychosocialhazard #enterpriseriskmanagement #companydirector

New Guidance for Insider Risks: A Must Read The UK’s National Protective Security Authority (NPSA) has recently updated their guidance regarding insider risks. The NPSA provides five principles to establish the foundation to better understand insider risk. In doing so, it should urge chief executives, their board and senior management to broaden their focus and elevate their prioritisation to seriously address their insider risks. Insider risk must be imbedded within enterprise risk management, including recruitment processes, after-(office) hours operations, on-site contractors, supply chain, third party management services, executive travel and residential services among other focal points. NPSA provides four definitions to set the ground rules for shared understanding: Insider- Any person who has, or previously had, authorised access to or knowledge of the organisation’s resources, including people, processes, information, technology, and facilities. Insider Risk - The likelihood of harm or loss to an organisation, and its subsequent impact, because of the action or inaction of an insider. Insider Threat - An insider, or group of insiders, that either intends to or is likely to cause harm or loss to the organisation. Insider Event -The activity, conducted by an insider (whether intentional or unintentional) that could result in, or has resulted in, harm or loss to the organisation. The NPSA message - “If you have people, you have insider risk”. This is a worthy and timely publication that should be read in conjunction with guidance from security authorities in your jurisdiction and support from your trusted security advisors. After you have read the NPSA guidance, please contact us to discuss insider risks in your context: https://lnkd.in/ez39JtP7 Please follow us on LinkedIn - https://lnkd.in/etGU_9pC Harris Security Management – Trusted, expert and independent security risk management consultants since 1983. www.harris.com.au Declaration: We appreciate and benefit from AI. However, we do not use AI to generate our blogs, posts, reports or specifications. We believe in professional curiosity and integrity, human creativity and the protection of intellectual property. Proud Corporate Partner with the Protective Security Network. © Harris Security Management, 29 March 2026. #chiefexecutive #governance #csuite #companydirector #enterpriseriskmanagement #securityriskmanagement #insuranceunderwriter

New Guidance for Insider Risks: A Must Read The UK’s National Protective Security Authority (NPSA) has recently updated their guidance regarding insider risks. The NPSA provides five principles to establish the foundation to better understand insider risk. In doing so, it should urge chief executives, their board and senior management to broaden their focus and elevate their prioritisation to seriously address their insider risks. Insider risk must be imbedded within enterprise risk management, including recruitment processes, after-(office) hours operations, on-site contractors, supply chain, third party management services, executive travel and residential services among other focal points. NPSA provides four definitions to set the ground rules for shared understanding: Insider- Any person who has, or previously had, authorised access to or knowledge of the organisation’s resources, including people, processes, information, technology, and facilities. Insider Risk - The likelihood of harm or loss to an organisation, and its subsequent impact, because of the action or inaction of an insider. Insider Threat - An insider, or group of insiders, that either intends to or is likely to cause harm or loss to the organisation. Insider Event -The activity, conducted by an insider (whether intentional or unintentional) that could result in, or has resulted in, harm or loss to the organisation. The NPSA message - “If you have people, you have insider risk”. This is a worthy and timely publication that should be read in conjunction with guidance from security authorities in your jurisdiction and support from your trusted security advisors. After you have read the NPSA guidance, please contact us to discuss insider risks in your context: https://lnkd.in/ez39JtP7 Please follow us on LinkedIn - https://lnkd.in/etGU_9pC Harris Security Management – Trusted, expert and independent security risk management consultants since 1983. www.harris.com.au Declaration: We appreciate and benefit from AI. However, we do not use AI to generate our blogs, posts, reports or specifications. We believe in professional curiosity and integrity, human creativity and the protection of intellectual property. Proud Corporate Partner with the Protective Security Network. © Harris Security Management, 29 March 2026. #chiefexecutive #governance #csuite #companydirector #enterpriseriskmanagement #securityriskmanagement #insuranceunderwriter

“Unlikely” It’s one of the most common words used when organizations talk about risk. Unlikely escalation. Unlikely disruption. Unlikely exposure. Until it isn’t. Global instability rarely stays exactly where it starts. It shifts travel patterns, changes local conditions, and creates opportunities for people willing to exploit the moment. For organizations responsible for executive movement, the real responsibility isn’t predicting the exact event. It’s recognizing that environments change faster than assumptions do. Experienced Executive Protection teams plan with that reality in mind. They assume conditions evolve. They assume plans may need to adjust. They assume preparation must happen before the problem appears. Because responsible security planning isn’t about reacting to the unexpected. It’s about refusing to rely on the word unlikely. #Surefox #ExecutiveProtection #SecurityLeadership #RiskManagement #SafelyForward

A difficult but necessary observation about the private security and close protection sector. Through independent operational reviews across multiple security environments, a consistent challenge continues to emerge - and it directly affects clients. In many cases, the greatest vulnerability is not the external threat environment, but the internal standards within parts of the security industry itself. Common issues observed across the sector include: • Deployment of underqualified or insufficiently trained personnel in high-responsibility protective roles • Compliance frameworks that exist on paper but lack operational implementation or oversight • Over-resourced deployments that increase cost without proportionate improvements in protective capability • Inadequate threat and risk assessments, resulting in security postures that are misaligned with the actual risk environment • Limited contingency planning and scalability, reducing resilience during elevated threat scenarios • Absence of independent review or governance, allowing ineffective practices to persist. The result is that organizations may inadvertently invest in security presence rather than effective risk mitigation. Professional protective security should be risk-led, intelligence-driven, and proportionate to the operating environment, with governance aligned to recognised international standards. This is why independent assessments and third-party reviews are increasingly important - ensuring that security strategies remain effective, accountable, and aligned with the client’s operational and financial interests. #ExecutiveProtection #SecurityGovernance #RiskManagement #ProtectiveSecurity #SecurityLeadership

Incidents in operational environments rarely start with a single major failure. They usually develop from a series of small conditions that exist at the same time. In many cases, those conditions look ordinary on their own: • A busy environment with limited staff • A policy that exists but is interpreted differently across shifts • An unusual situation that no one has encountered before • A delay in recognizing that something isn’t normal None of these factors automatically creates an incident. But when several of them occur together, the environment becomes more vulnerable to problems developing. One thing that becomes clear when reviewing incidents is that escalation often happens gradually. What begins as a small disruption, misunderstanding, or unusual behavior can develop into a larger issue if the situation isn’t recognized early. Because of that, many organizations focus heavily on response. But prevention often begins earlier — with recognizing patterns, maintaining situational awareness, and ensuring that teams understand how to respond consistently when something unexpected happens. Another aspect of this work that isn’t often discussed publicly is confidentiality. Organizations that allow outside professionals to observe operational practices are often sharing areas of vulnerability during the process. Because of that, I never disclose the names or locations of past or current clients. Operational transparency only works when trust exists. Nicholas Krug | Owner | Principal Security Advisor | Fortis Strategic Security Advisors | Vigilance. Integrity. Resolve. | fortissecadv.com | fortisadvisor@proton.me #RiskManagement #OperationalRisk #HospitalityOperations #SituationalAwareness #OperationalDefensibility

Foreign Intelligence Service (FIS) Activities are Prevalent in Australia. FIS are involved in a range of activities such as theft, sabotage, intimidation and intelligence gathering. Government departments, commercial enterprises and specific sections of the community are targeted. FIS are strongly suspected to be involved in protest movements in democratic countries. Organisations that have risks associated with FIS activity should ensure critical areas such as policies, recruitment, onboarding, facilities, travel, conferences, collaboration, supply chain, 3rd party management, executive residences and reporting systems have clear goals, assessments and procedures that are fit for purpose to manage this threat. This is a matter of good governance. Our experience states all organisations have security vulnerabilities ready to be exploited. While corporations operating in a regulated security domain such as defence contractors are aware of FIS risks, other organisations need to objectively identify their value to FIS for example, their R&D, their products, their subject matter experts and logistics. Being a target to FIS should not be dismissed as fanciful. It should be evaluated. Not all FIS activity comes from the outside of the organisation. There have been many cases where trusted insiders were involved in this criminal activity. Managing the FIS threat against organisations starts with executive acceptance of the risks with a whole of enterprise focus that delivers and sustains effective fit-for-purpose countermeasures. ASIO and partner agencies provide information and advice that should be well considered by Boards and C-suite executives, for example: Espionage https://lnkd.in/eRNppA_3 Travelling Overseas https://lnkd.in/g8DxaJ2R Insider Threat https://lnkd.in/g8c49USV In a very recent example of FIS activity in the UK, four men have been arrested on suspicion of spying for Iran. This type of FIS mission is closer than you may think: https://lnkd.in/gjJ_UWKR If you would like more information or advice, please contact us. Please follow us on LinkedIn - https://lnkd.in/etGU_9pC Harris Security Management – Trusted, expert and independent security risk management consultants since 1983. www.harris.com.au Declaration: We appreciate and benefit from AI. However, we do not use AI to generate our blogs, posts, reports or specifications. We believe in professional curiosity and integrity, human creativity and the protection of intellectual property. Proud Corporate Partner with the Protective Security Network. © Harris Security Management, March 2026. #companydirector #c-suite #corporategovernance #humanresourcemanagement #psychosocialhazard #enterpriseriskmanagement #criticalinfrastructure #supplychain #facilitiesmanagement #research #internationaltravel  

When Risk Shows Up in Real Time One of the realities of governance and risk management is that risk rarely announces itself politely. It usually arrives all at once, from different directions, forcing leaders to make decisions with incomplete information and very little time. That’s true in cybersecurity, in business, and frankly, in the real world. Look at the headlines right now. Geopolitical tensions with Iran remind us how quickly global events can shift risk landscapes overnight, markets, supply chains, energy, and national security all interconnected. At the same time, political disputes around voting procedures in places like Texas, show how governance processes themselves, can become high-stakes operational events when trust, rules, and accountability are under pressure. The lesson for anyone in GRC is the same: risk compounds when systems aren’t designed to handle stress. Whether it’s geopolitical conflict, institutional governance, or corporate operations, resilience doesn’t come from reacting in the moment. It comes from preparation, clarity of roles, defined processes, and the discipline to operate inside guardrails when the pressure rises. When things get chaotic, the organizations, and institutions that perform best, are the ones that already know how decisions will be made, who owns the controls, and what happens when something goes wrong. So, here’s your Hump Day Dump: Risk doesn’t care whether you’re running a company, managing a security program, or governing a system. When pressure hits, whatever structure you built beforehand is the structure you’re stuck with. Build governance and controls before the crisis, because that’s not the time to figure out how the system works. That’s your Hump Day Dump, see you next Wednesday. #HumpDayDumpWithJim #GRC #RiskManagement #Governance #CyberSecurity #Leadership #WednesdayWisdom #OpenToWork

The market is shifting and not necessarily in the right direction. We’re watching large providers consolidate intelligence, advisory, and risk services into centralized, scaled models. Efficient? Yes. Aligned? Absolutely. Independent? That’s the real question. Because when advisory sits inside a delivery model, it doesn’t stay neutral for long. At some point, it stops being objective guidance and starts becoming aligned guidance. That may work for some. It doesn’t work at the level we operate. At ICMG, we’ve made a deliberate decision: No guarding business. No technology agenda. No internal bias to satisfy. Just experienced operators delivering clear, unfiltered guidance when it matters most. Because the best advice doesn’t have to fit anything else.

The security risk environment continues to develop.   There is a visible shift toward consolidation of intelligence, advisory, and consulting within larger, centralized structures.   This reflects a broader move toward scale and integration across the industry.   At the senior decision-making level, expectations remain clear.   Clients require: • Objective, well-grounded insight • Intelligence that maintains its integrity • Direct access to experienced advisors   At International Crisis Management Group (ICMG), advisory is delivered as a dedicated, experience-led service. Our teams work closely with clients, providing focused support aligned to their specific operating context. This approach supports clear decision-making based on experience, judgment, and relevance.   As risk increases, the role of independent advisory remains critical in shaping effective outcomes #ICMG #RiskAdvisory #SecurityIntelligence #CrisisManagement #ExecutiveProtection #InternationalCrisisManagementGroup