Designing the Insider Threat Module: Training That Changes Behaviour
You are asked to build a 90-minute insider threat awareness module for 600 aerodrome staff: baggage handlers, cleaners, retail workers, engineers, and office staff. The current module is a 60-slide presentation on the definition of insider threat, followed by a 10-question multiple-choice test with a pass mark of 70%. Completion is at 98%, but a post-course survey shows that only 31% of staff could describe what they would actually do if a colleague's behaviour seemed unusual. Two real events in the past year went unreported for weeks: a cleaner repeatedly accessed a store room outside her duties, and an engineer photographed a security control room. Both were noticed by colleagues who said nothing because they 'did not want to get anyone in trouble'.
1. Diagnose why the current module fails, using adult learning principles.
Read the worked answer
The module fails on several adult learning principles. First, it is content-centred rather than performance-centred: 60 slides on definitions build knowledge, but the desired outcome is a behaviour - reporting a concern. The survey result (31% can describe what to do) shows the transfer gap. Second, it does not address the actual barrier. The colleagues noticed the behaviour; what stopped them was a social belief that reporting harms a colleague. A module that does not surface and work on that belief will not change behaviour, however well it defines insider threat. Third, the assessment measures recall of definitions, not the judgement to act, so the 98% completion and 70% pass mark give false assurance. Fourth, it treats a heterogeneous audience as one: a cleaner, an engineer, and an office worker see different things and face different reporting paths. Fifth, it is passive - slides and a test - for adults who learn best from realistic scenarios, discussion, and practice of the actual behaviour. The instructor's diagnosis should connect the two unreported events directly to these design failures.
2. Redesign the 90 minutes. Specify the structure, the activities, and how you handle the 'I don't want to get anyone in trouble' barrier.
Read the worked answer
Structure: 10 minutes on why this matters, anchored in a realistic anonymised scenario rather than a definition; 15 minutes on what concerning behaviour looks like in each role's context, using role-specific examples; 20 minutes on a decision exercise - small groups work three short scenarios and decide what they would do and to whom; 15 minutes on the reporting pathway, walked through concretely, including what happens after a report and what the reporter's protections are; 15 minutes on the barrier itself, facilitated discussion; 15 minutes on a short applied assessment and close. Handle the barrier directly, not by assertion. Ask the group what would make them hesitate, capture the answers, and work through them: reporting is not an accusation, it is a handover to someone whose job is to check; the colleague who is innocent is protected by a proper process; the colleague who is not is a risk to everyone in the room. Use a scenario where a report turns out to be nothing and show that this is a good outcome. Have a supervisor or a person from the receiving function present to describe what happens to a report, so the pathway is a real place with a real person, not an abstract duty.
3. How would you evaluate whether the redesign worked, beyond a satisfaction survey and a multiple-choice test?
Read the worked answer
Use a chain of evidence. Reaction: brief, targeted feedback on relevance, not general enjoyment. Learning: scenario-based assessment where staff must state what they would do and to whom, scored against a rubric, with a defined pass standard that reflects the behaviour, not recall. Behaviour: monitor reporting volumes and, crucially, the quality and timeliness of reports over the following six months - a rise in reports shortly after training is expected and is a positive signal, not a problem. Track time-to-report for any concerns raised. Results: track whether concerns are being raised earlier than in the past, and review any near-miss or incident where a colleague had prior awareness. Compare the 31% baseline on the 'can you describe what you would do' question at a follow-up interval. Also evaluate the delivery: observe a sample of sessions for facilitation quality, since a scenario-based module depends heavily on the instructor's skill in handling the barrier discussion. Present the results as a before-and-after picture to management, and feed the findings into the next design cycle.