After a whole afternoon on AI, platforms and verification, the last conversation at VERGE: Comprehensive Security turned the room around. Carolina Angelis of Truesec on insider threats, and why the answer is care, not paranoia.

Carolina Angelis spent almost twenty years in the Swedish intelligence community. Today she leads human threat intelligence at Truesec, helping companies and agencies spot infiltration, espionage and insider threats before they cause damage. In her spare time she has written four spy thrillers.

She was asked a direct question. After everything we’ve heard today, is the human still the biggest vulnerability?

Her answer: yes.

The strongest wall doesn’t help if the wrong person is inside

Carolina knows it’s a controversial thing to say. We’re supposed to say that people are our greatest strength. But it doesn’t matter how strong the technical defence is if the wrong person is already on the inside.

People can be both the greatest vulnerability and the greatest strength. Which one depends on how you treat them.

Insider threats are hard to detect for three reasons. The person already has access. They are trusted. And they have the time and the knowledge to act.

People rarely join to betray

Most people don’t apply for a job intending to be disloyal. It happens later. Something changes: in their life, at work, in their finances.

The motives vary. Some act on their own, because they’re disgruntled, don’t feel seen or were passed over. In most of the cases Carolina has looked at, someone else was paying. But it’s rarely only about money, even when it looks that way. It’s usually a combination of motives, pressures and vulnerabilities that someone has learned to use.

That has a direct consequence for how organisations work. Checking people when they’re hired isn’t enough. You also need to follow up.

Hiring is two jobs, not one

Carolina’s advice is to split recruitment into two separate processes, run by different people:

1. Talent acquisition. Finding the best people for the role and the team.
2. Security vetting. Looking for vulnerabilities that someone else could use to put pressure on that person.

The recruitment team can then focus on talent, while vetting gets the attention it needs.

Remote hiring has made this harder. The first question is whether the person you think you’re hiring is really that person. Fake identities are nothing new in espionage. But add distance, technology and AI, and it becomes much harder to know who you are actually letting in.

The signals are almost always there

Carolina described a pattern she has seen again and again. When an insider case comes to light, people say: we saw that, we heard that, we knew. But no one acted.

The reason is trust. We’re a family here. Nobody can imagine a colleague doing harm on purpose.

Possible warning signs include:

• Expressing strong negative feelings about the organisation.
• Changing working patterns, such as being in the office very late or very early. This can of course have an innocent explanation, like a change in family life.
• Trying to get around security.
• Seeking more access than the role needs.

In several recent espionage cases that have been reported in Sweden, the signs had been visible for a long time.

Care, not paranoia

The question everyone asks is how to watch for signals without turning the office paranoid. Carolina’s answer changes how the whole issue looks.

If you notice that someone isn’t feeling well, that something has changed, talk to them. Ask how they are. Ask if there’s anything the organisation can do to help.

That way, you may be able to help that person before a threat actor, a criminal network or a foreign intelligence service finds the vulnerability and uses it. That isn’t surveillance. It’s taking care of people.

And the responsibility lands on all of us. “See something, say something” rarely works on its own, because people are afraid of being wrong. That’s why the board and management have to take the issue seriously and talk about it openly.

Months to recruit, minutes to rent

How long would it take Carolina to get into one of the companies in the room, not through the firewall but through the people? She would never do it, she said. But recruiting a real insider normally takes months, from the first approach until someone delivers valuable information. For an actor who then gets years or even decades of access, a few months is nothing.

At the same time, something faster is growing: so-called disposable agents. Criminal groups and others recruit people online, on gaming sites and similar platforms, and pay them for small tasks such as sabotage or mapping a secure area. They don’t need much access. And it happens fast.

Fiction that no longer sounds unlikely

Carolina toned down her first novel. Even so, a publisher found the plot, about a plague outbreak in a Russian biological weapons lab, a little too unlikely. Her latest book, about influence operations aimed at dividing Europe and weakening support for Ukraine, met no such objections. Readers see how close it is to reality. She no longer tones anything down.

What to do on Monday

Carolina’s message to leaders was short: stop being naive. Keep the focus on technology, but remember that organisations are made of people, and that some actors are actively looking for the ones who are vulnerable.

• Put insider risk on the agenda of the management team and the board.
• Separate talent acquisition from security vetting in your recruitment process.
• Make sure you can confirm the identity of the people you hire remotely.
• Follow up over time, not only at hiring.
• Help managers notice changes, and ask people how they’re doing.

About the speaker

Carolina Angelis leads human threat intelligence at Truesec. She spent almost twenty years in the Swedish intelligence community and is the author of four spy thrillers.

This article is part of VERGE Pulse, a series of insights from VERGE: Comprehensive Security at Epicenter Stockholm on 19 October 2026. VERGE is Epicenter’s flagship event series, bringing founders, leaders, investors and experts into one room to explore the questions that will shape the next decade.

Want to talk about resilience in your own organisation, or shape the next VERGE with us? Get in touch with the Epicenter team.