Insider Threats in UK Universities: Protecting Research and Future Talent
For years, when I thought about British universities, I thought about remarkable discoveries, talented people and breakthroughs that had improved lives around the world. I would not have imagined that I would eventually be writing about the opportunities those same institutions present to hostile actors, yet their success helps explain their appeal.
When I consider insider threats in UK universities, I see more than stolen files or compromised systems. Universities bring together valuable research, commercial relationships and people whose careers could take them into strategically important organisations. My concern is that we recognise the importance of the research without always recognising the opportunities to exploit the people around it, including long before they reach a sensitive position.
What the recent warnings tell us
On 30 September 2026, MI5 issued an espionage alert concerning the China General Technology Research Institute. It said more than 100 UK linked academics had contributed to research projects funded through the organisation by China’s Ministry of State Security. In some cases, academics might not have known the organisation was funding the research they were contributing to.
Earlier this year, a Five Eyes bulletin published by MI5 warned about Chinese intelligence officers posing as recruiters and consultants through apparently legitimate companies on professional networking and recruitment platforms. These warnings demonstrate why research security cannot be treated solely as a technical problem: the opportunity can arrive through a relationship that appears entirely credible.
For me, the practical question is how well equipped the person receiving an approach is to recognise its purpose. A respected academic may understand their subject exceptionally well without having experience of deceptive recruitment. A talented student may have little experience of professional relationships at all. Expertise in research does not automatically prepare someone to recognise exploitation.
Insider threats in UK universities: the cultivation risk
I consider universities a prime environment for hostile cultivation, by which I mean developing a relationship that can later be used to influence someone or obtain their assistance. Researchers discuss ideas, seek funding and attend conferences, while students build connections and explore employment opportunities. Those normal activities give a hostile actor opportunities to establish contact without revealing their purpose.
Where awareness is limited, an approach may go unrecognised. Where responsibilities are fragmented, nobody may see the full relationship. There can also be disbelief that this could happen here, to this person, or within this apparently unremarkable project. In my view, that combination gives someone with patience and a concealed purpose considerable room to operate.
The scale of a university makes this harder. Security teams may support numerous departments, laboratories, visiting researchers and commercial partnerships, each with different relationships and requirements. ARMA’s research security work has identified challenges involving resources, ownership, accountability and specialist expertise. Having a policy or a named lead does not establish whether an institution has enough capacity to apply its arrangements consistently.
I am used to environments where security responsibilities and escalation routes were established parts of the organisation. Universities have a different purpose, but clear responsibility, trained assessment and proportionate action transfer well. Physical security, cyber security and research compliance all contribute; none automatically provides the specialist judgement needed to assess cultivation or connect separate human concerns.
The relationship may begin before the access
A student may not hold sensitive information today, but their expertise could eventually take them into advanced engineering, biotechnology, defence research or another important field. I believe we need to assess that future potential alongside their current access. If a hostile actor thinks in years rather than weeks, why assume they would wait until someone entered a sensitive role before developing a relationship?
Consider a fictional scenario involving an engineering student who meets someone presented as an industry mentor. The contact takes an interest in their ambitions, offers encouragement and helps them understand the professional world they hope to enter. During their studies, the student experiences financial pressure and uncertainty about their future, and the mentor remains supportive. Over several years, the relationship becomes a friendship.
The student graduates, progresses through research and eventually joins a technology company working on commercially sensitive projects. The friendship continues, and conversations naturally turn to work. They freely discuss technical challenges, project priorities and unpublished developments without recognising the risk. This is someone who has supported them for years, so they see an ordinary conversation with a trusted friend rather than an attempt to obtain information.
From the employer’s perspective, an authorised employee is carrying out their normal duties. From the individual’s perspective, the friendship has nothing to do with security. Behind that relationship, however, a hostile actor is gaining knowledge through trust established before the sensitive role existed. This is the long term social engineering pathway I believe deserves more attention.
The university’s opportunity to intervene begins during those formative years. Helping students recognise concealed interests and understand professional boundaries can protect their current research and the organisations they later join. Waiting until someone holds sensitive access means missing an earlier opportunity to prepare them.
Admission is not the same as security assurance
I also see a direct access risk where international students or visiting researchers enter sensitive work without adequate checks on their backgrounds, affiliations, funding and ongoing obligations. Academic suitability does not establish whether someone has concealed military, intelligence or commercial connections. Where checks are incomplete, an institution may grant access without understanding the interests behind it.
The risk can involve someone deliberately seeking access or someone subsequently pressured into providing information. An initial check cannot account for every relationship or change in circumstances that follows, which is why I would want institutions to understand who can reach valuable research, why they need that access and whether external obligations create conflicts. Proportionate due diligence and access management are central to the Trusted Research approach.
For me, the test is whether an institution understands the access it has granted and can recognise when that access is being exploited. Admission checks, declarations and security awareness need to support an ongoing understanding of risk rather than become separate administrative exercises.
Why welfare belongs in the security discussion
And let’s be honest: rent, debt, family responsibilities and uncertainty about future income are real concerns. Someone approaching the end of their funding may see external support as a lifeline. Someone who feels isolated may place considerable value on a relationship offering recognition and encouragement, particularly when that support has been consistent over time.
I think this applies to educators as much as students. Experience in teaching or research does not remove personal pressures, and ambition or enthusiasm for the work can also be exploited. Personal, professional and financial pressures, together with the organisation’s response, are recognised considerations in insider risk guidance.
That gives welfare support a practical security value. It can reduce isolation and provide somewhere to discuss an opportunity or relationship before a problem develops. Support must remain trusted and confidential, with any security information sharing justified and proportionate. I want people to feel able to ask for help, not fear that doing so will automatically turn them into a security concern.
What could research exploitation cost the UK?
The immediate loss might be unpublished findings or commercially sensitive information. The longer consequences could include lost investment, damaged partnerships and reduced competitive advantage. Research also produces knowledge that is not neatly contained in a document: knowing why an experiment failed or which approach looks promising can save someone considerable time and effort.
This is why I keep returning to the people involved. The knowledge is in their heads, not necessarily locked away on a secure server, and protecting a final report will not protect everything they have learned while producing it. A conversation can disclose something valuable without a file ever being downloaded.
Consider the Manchester Baby. On 21 June 1948, the team involving Freddie Williams, Tom Kilburn and Geoff Tootill achieved a computing landmark when an electronic computer successfully ran a program stored in its memory. How would we have valued that work then: the equipment, the salaries or the project funding? None would have captured its future significance.
I use that example because a discovery’s importance can extend far beyond what is visible at the time. When research is exploited or a business loses its development advantage, the consequences could affect commercialisation, investment and skilled employment for years. For the researcher, it could also mean professional consequences and discovering that a valued relationship was built around deception.
I do not have a defensible total for what that costs the UK over ten or twenty years. But difficulty measuring the loss is not a reason to ignore it. My concern is that some of the most consequential damage may only become apparent long after the original disclosure, when the opportunity to prevent it has passed.
What I would want university leaders to do
I would start by asking whether people understand the risks in the relationships around them. Would a student recognise that a helpful contact could have a concealed purpose? Would a researcher understand the boundaries around discussing unpublished work? Would a supervisor know where to take a concern that does not yet amount to an incident?
Training should address realistic situations, including trusted friendships and longstanding professional relationships. Reporting should accommodate uncertainty, so people do not need to prove hostile intent before asking for advice. There also needs to be a named accountable owner, access to competent assessment and an agreed process for coordinated decisions across the relevant teams.
As I argued in September’s article on intelligence led security, separate observations only help an organisation when there is a disciplined way to assess what they mean together. A practical exercise could reveal a great deal here: give the relevant teams an ambiguous scenario and work through responsibility, support, information sharing and escalation. Wherever the answers become unclear, there is useful work to do.
My assessment is that exploitation of professional relationships and legitimate access will become an increasingly important research security challenge. Valuable research, emerging talent and uneven awareness create opportunities that institutions cannot afford to dismiss. Strong cyber security remains essential, but it cannot, on its own, resolve a relationship in which someone willingly shares knowledge with a person they trust.
At Insider Threat Limited®, our focus is the human and organisational side of insider risk, including awareness, trusted reporting and specialist assessment. Our insider risk training and exercises help organisations put that understanding into practice. For academia, I believe the objective should be to protect the people and relationships that make research successful, while recognising when somebody is exploiting them.
British universities have helped shape the world we live in. Protecting their future contribution means looking beyond the research they hold today and considering the people who will create tomorrow’s discoveries, the relationships forming around them and whether anyone is equipped to recognise the risk.
Great article. Spot on advice.