What recurrent vetting was built to catch

Consider a security agent eight years into the job. Cleared at hire, cleared at every renewal since, enrolled in recurrent criminal record checking, never the subject of a single notification. On paper, continuously vetted.

Eighteen months ago something changed. A second job that did not quite cover the gap. A relationship with someone who asked a small favour, then a slightly larger one.

Nothing that produced a police record, because nothing about the arrangement was designed to.

Every control in that operation performed exactly as specified. None of them was built to see this.

What the check actually does

Recurrent vetting has been a genuine advance. In the United States, workers with unescorted access to restricted and sterile areas moved from periodic criminal history checks to enrolment in the FBI's Rap Back service, which notifies the employer when new criminal history information is reported. ICAO maintains an insider threat toolkit advising that background check policies be reviewed periodically and supported by ongoing quality control. In Europe, EC 300/2008 sets the personnel security baseline national authorities audit against.

So the principle is settled. Nobody now argues that a check performed once at hire is sufficient.

The mechanism is what repays attention. Recurrent checking is a notification service, triggered when a second institution records a formal interaction with an individual. The employer is not observing anything. It is subscribing to someone else's observation, and only to those serious enough to have produced a record.

The detection threshold, in other words, is criminal charge. Everything before a charge, and everything that never produces one, sits outside it.

Where that leaves the three insider types

Malicious insiders act deliberately. Some carry prior records, and recurrent checking will occasionally surface one.
Negligent insiders create exposure without intent: procedures skipped under pressure, training left incomplete, access used casually. There is no record at any point. Recent research into insider risk cost identifies negligence, not malice, as the largest single cost driver.
Compromised insiders are the least comfortable category. A clean employee who has become vulnerable through debt, personal crisis or coercion. They passed vetting honestly and would pass again tomorrow. Where someone is coerced, the police interaction that would generate a notification may never occur, and if it does, it occurs afterwards.

Two of the three sit structurally outside what record-based checking can reach. Both changes are behavioural, and behaviour is not what the check observes.

What is observable instead

The data that would describe those changes already exists, in fragments, in systems most operations already run:

Access control holds where every credential has been presented, and when
Rostering holds where each person was meant to be
HR holds role, contract status and reporting lines
Learning management holds whose completions have quietly stopped
Incident records hold the organisational memory

None of these is a security system in the insider sense. Collectively they describe how a person operates in considerable detail.

An access event in an unusual zone means nothing alone. A lapsed training record means nothing alone. A cluster of shift swaps means nothing alone. The same three facts, attached to one person, in the same six weeks, mean something.

The signal lives in the relationship between events, never in a single event.

What makes this workable in practice is baselining each individual against their own established pattern rather than a population threshold. Rules set against an average flag everyone whose working life legitimately differs from the norm, which generates volume nobody can work and does so in demographically uneven ways. A permanent night-shift officer is not flagged for working nights, but for ceasing to resemble themselves.

What regulators have started asking

NIS2 makes management bodies responsible for approving and overseeing risk-management measures and liable for infringements, with several member states adding personal liability provisions. Enforcement is live, with first penalties issued in several jurisdictions during 2026.

What they share is a shift in the question. Not whether a process exists, but whether oversight is continuous, evidenced and owned by a named person. A folder of completed checks answers the first. It does not answer the second.

There is a question the ICTS team puts into most first meetings, and it rarely gets a comfortable answer.

If a trusted, long-serving employee started acting as a threat actor tomorrow, what is the very first signal the organisation would receive, and when would it arrive?

For operations relying on recurrent record checking alone, the first signal comes from a police force. That is a real capability, and it arrives at a point of someone else's choosing.

Iveron. Predict. Detect. Protect. From insider threat.