Accounting for Protective Factors in Screening, Vetting, and Insider Threat Decision-Making
Primary guidance for screening and vetting future employees comes from HR/ER, and advocates for considering the whole-person including unfavorable and favorable information. Practically, favorable information is currently utilized only to mitigate unfavorable information, and few efforts have been made to otherwise use favorable information. MITRE behavioral scientists proposed that whole-person buffers (i.e., protective factors) could be used by screening and vetting and insider threat detection programs to triage and better leverage favorable information.
MITRE’s research project used behavioral science research to identify “protective factors”, defined as “individual characteristics, attitudes, social perceptions, or behaviors that provide a whole-person buffer to reduce the risk of individuals making poor decisions and becoming insider risks or threats”. The MITRE research team conducted a scan of the scientific research literature which led to creating a list of more than 350 different protective factors. This list was consolidated down to 27 factors by examining the feasibility, practicality, and cultural robustness of each factor within personnel vetting and insider threat detection contexts. The research team and the government sponsor selected 3 protective factors (empathy, adaptability, and life satisfaction) for a validation study based on operational applicability and availability of behavioral, family or manager reports, and self-report measures. The experimental validation study included 40 newly hired and 66 tenured employees of a medium-sized, Washington D.C.-based organization to determine whether the behavioral and family/manager security questions measured the protective factors. The study results identified two questions in which family members’ responses were valid measures of empathy in a personnel vetting context; however, none of the current measures were validated using data typically available to Insider Threat/Risk Programs. It is recommended that empathy measures be piloted as the first observable protective factor. None of the adaptability measures proved valid for observable measurement in either the personnel vetting or insider threat context. Finally, we rejected life satisfaction measures as a suitable protective factor after participants’ responses—which were heavily influenced by recent, negative, life changes— indicated it was similar to potential risk indicators, as opposed to a protective factor that reduces risk.