How exposed is your IP to corporate espionage and insiders?
Tell us what you protect and how, across 9 domains and 29 controls. Get a score by domain, your top insider and espionage risks, and the controls to add first.
What you protect
Your scorecard
High
readiness
High
- Crown-jewel IP33/100
- Access controls33/100
- Departing employees33/100
- Data loss prevention33/100
- Travel and foreign contact33/100
- Third-party access33/100
- Monitoring and detection33/100
- Insider program and reporting33/100
- Legal and trade-secret program33/100
A relative model: residual risk blends exposure (45%) with control gaps (55%). Not a probability of theft.
What raises your exposure
- Staff travel abroad with company devices
- Remote and hybrid work move data off controlled premises
Weakest domains: Crown-jewel IP (33), Access controls (33), Departing employees (33).
Top risks and the controls to add
Ranked by gap size, weighted for your exposure.
- 1
Crown-jewel inventory
Crown-jewel IP · now: Informal, people knowRisk: You cannot protect, monitor or later prove theft of IP you have not identified.
Add: Name the 10 to 20 pieces of information whose loss would hurt most, give each an owner, and map where each lives (repos, PLM, shares, SaaS).
Guidance: Carnegie Mellon SEI (CERT), FBI
- 2
Least-privilege access to the IP
Access controls · now: Some role restrictionsRisk: Most insider thieves already had legitimate access; wide access multiplies who can take it.
Add: Make the IP owner approve access, scope it to the project, and expire it when the project ends.
Guidance: Carnegie Mellon SEI (CERT), CISA
- 3
Look-back on departing staff activity
Departing employees · now: Only if someone raises a concernRisk: CERT and CISA both single out departing employees as a high-risk group for IP theft; without a look-back you may find out from a competitor.
Add: When someone in an IP-holding role resigns, review their recent downloads, cloud uploads, USB use, email forwarding and print activity.
Guidance: Carnegie Mellon SEI (CERT), CISA
- 4
Devices for travel abroad
Travel and foreign contact · now: Advice onlyRisk: Devices taken abroad can be searched, imaged or compromised, especially at borders and hotels.
Add: Issue clean loaner devices for high-risk destinations, carry only what the trip needs, and inspect or wipe them on return.
Guidance: FBI, US National Counterintelligence and Security Center (NCSC)
- 5
Segregation of the IP
Crown-jewel IP · now: Some in restricted foldersRisk: Crown jewels on open shares are reachable by every compromised or disgruntled account.
Add: Move crown-jewel IP into dedicated, need-to-know repositories separate from general file shares.
Guidance: Carnegie Mellon SEI (CERT), FBI
- 6
Privileged and admin accounts
Access controls · now: Named but standing admin rightsRisk: Admins can read and export everything, and can disable the logs that would show it.
Add: Separate admin accounts, phishing-resistant MFA, just-in-time elevation and recorded sessions on systems holding IP.
Guidance: Carnegie Mellon SEI (CERT), CISA
Scorecard and action plan
Scores, the top eight risks with controls to add, and every answer.
Preview the plan
CORPORATE ESPIONAGE & INSIDER RISK SCORECARD Generated 2026-10-31 with PlayCISO (playciso.com/tools/insider-espionage-risk-scorecard) Profile: Software and SaaS; crown jewels: Source code, Customer lists and pricing. Exposure 57/100 (High). Control readiness 33/100. Residual risk 63/100 (High). READINESS BY DOMAIN - Crown-jewel IP: 33/100 - Access controls: 33/100 - Departing employees: 33/100 - Data loss prevention: 33/100 - Travel and foreign contact: 33/100 - Third-party access: 33/100 - Monitoring and detection: 33/100 - Insider program and reporting: 33/100 - Legal and trade-secret program: 33/100 TOP RISKS AND CONTROLS TO ADD 1. Crown-jewel inventory (Crown-jewel IP). Now: Informal, people know Risk: You cannot protect, monitor or later prove theft of IP you have not identified. Add: Name the 10 to 20 pieces of information whose loss would hurt most, give each an owner, and map where each lives (repos, PLM, shares, SaaS). 2. Least-privilege access to the IP (Access controls). Now: Some role restrictions Risk: Most insider thieves already had legitimate access; wide access multiplies who can take it. Add: Make the IP owner approve access, scope it to the project, and expire it when the project ends. 3. Look-back on departing staff activity (Departing employees). Now: Only if someone raises a concern Risk: CERT and CISA both single out departing employees as a high-risk group for IP theft; without a look-back you may find out from a competitor. Add: When someone in an IP-holding role resigns, review their recent downloads, cloud uploads, USB use, email forwarding and print activity. 4. Devices for travel abroad (Travel and foreign contact). Now: Advice only Risk: Devices taken abroad can be searched, imaged or compromised, especially at borders and hotels. Add: Issue clean loaner devices for high-risk destinations, carry only what the trip needs, and inspect or wipe them on return. 5. Segregation of the IP (Crown-jewel IP). Now: Some in restricted folders Risk: Crown jewels on open shares are reachable by every compromised or disgruntled account. Add: Move crown-jewel IP into dedicated, need-to-know repositories separate from general file shares. 6. Privileged and admin accounts (Access controls). Now: Named but standing admin rights Risk: Admins can read and export everything, and can disable the logs that would show it. Add: Separate admin accounts, phishing-resistant MFA, just-in-time elevation and recorded sessions on systems holding IP. 7. Access removal on notice (Departing employees). Now: On the last day Risk: A notice period with full access is a window to collect. Add: Trigger access reduction from HR when notice is given for crown-jewel roles, and verify full removal at exit. 8. Removable media and personal cloud (Data loss prevention). Now: Policy only Risk: USB drives and personal cloud storage are the classic way IP walks out. Add: Block USB storage and personal cloud sync by default on devices that reach IP; log approved exceptions. ALL ANSWERS - Crown-jewel inventory: Informal, people know - Classification and marking: Policy exists, rarely used - Segregation of the IP: Some in restricted folders - Least-privilege access to the IP: Some role restrictions - Access reviews: Ad hoc - Privileged and admin accounts: Named but standing admin rights - Look-back on departing staff activity: Only if someone raises a concern - Access removal on notice: On the last day - Exit interview and reminder of obligations: Informal chat - Removable media and personal cloud: Policy only - DLP on email, web and endpoints: Email only - Public AI tools and paste-out: Policy only - Devices for travel abroad: Advice only - Pre-travel briefing and elicitation awareness: Generic travel advice - Reporting unusual foreign contact and approaches: Mentioned in training - Visitor and delegation controls: Sign-in only - Contractor and partner access: Some restriction - Third-party contracts: Standard NDA - Third-party offboarding: Removed when someone notices - Logging on crown-jewel systems: Some logs, not kept - Detection of unusual collection: Manual checks after a concern - Remote access monitoring: VPN logs only - Insider threat program: Security handles it alone - Reporting channel for concerns: Tell your manager - Training on insider and espionage risk: Generic security training - Confidentiality and invention assignment: Some staff - DTSA whistleblower immunity notice: Not sure - Documented "reasonable measures": Scattered policies - Playbook for suspected IP theft: General incident plan Relative model built on CISA, US NCSC, FBI and CERT guidance and 18 U.S.C. 1831-1839. Not legal advice and not a prediction that theft will or will not happen. Involve counsel before acting on a suspected insider.
Loading…
Your controls today
Set each control to where you really are. The scorecard updates as you go.
Crown-jewel IP (3)Know exactly what you are protecting and where it lives.
Access controls (3)Least privilege to the IP, and proof of who touched it.
Departing employees (3)The highest-risk window for IP theft.
Data loss prevention (3)Control how IP can leave: USB, cloud, email, print, AI tools.
Travel and foreign contact (4)Devices abroad, elicitation, foreign approaches and visitors.
Third-party access (3)Contractors, JV partners, suppliers and offshore teams.
Monitoring and detection (3)Seeing unusual collection before the data is gone.
Insider program and reporting (3)A cross-functional team and a way for staff to raise concerns.
Legal and trade-secret program (4)The "reasonable measures" that make IP a trade secret in court.
TL;DRThe short answer
5 points
- Corporate (industrial) espionage usually needs an insider: an employee, contractor or partner who already has legitimate access to the IP.
- US law separates economic espionage (a trade secret stolen to benefit a foreign government, 18 U.S.C. 1831) from theft of trade secrets for anyone else's benefit (1832).
- Information is only a trade secret if you took "reasonable measures" to keep it secret (18 U.S.C. 1839(3)). The controls in this scorecard are also your evidence.
- CISA and CERT both point to the same core: know your crown jewels, limit and log access, watch departures, control data movement and run a cross-functional insider program.
- The score is a transparent relative model built on that guidance, not a prediction that theft will or will not happen.
The nine domains and where they come from
Know exactly what you are protecting and where it lives.
Crown-jewel inventory · Classification and marking · Segregation of the IP
Guidance: Carnegie Mellon SEI (CERT), FBI
Least privilege to the IP, and proof of who touched it.
Least-privilege access to the IP · Access reviews · Privileged and admin accounts
Guidance: Carnegie Mellon SEI (CERT), CISA
The highest-risk window for IP theft.
Look-back on departing staff activity · Access removal on notice · Exit interview and reminder of obligations
Guidance: Carnegie Mellon SEI (CERT), CISA
Control how IP can leave: USB, cloud, email, print, AI tools.
Removable media and personal cloud · DLP on email, web and endpoints · Public AI tools and paste-out
Guidance: Carnegie Mellon SEI (CERT)
Devices abroad, elicitation, foreign approaches and visitors.
Devices for travel abroad · Pre-travel briefing and elicitation awareness · Reporting unusual foreign contact and approaches · Visitor and delegation controls
Guidance: FBI, US National Counterintelligence and Security Center (NCSC)
Contractors, JV partners, suppliers and offshore teams.
Contractor and partner access · Third-party contracts · Third-party offboarding
Guidance: CISA, Carnegie Mellon SEI (CERT)
Seeing unusual collection before the data is gone.
Logging on crown-jewel systems · Detection of unusual collection · Remote access monitoring
Guidance: Carnegie Mellon SEI (CERT), CISA
A cross-functional team and a way for staff to raise concerns.
Insider threat program · Reporting channel for concerns · Training on insider and espionage risk
Guidance: CISA, US National Counterintelligence and Security Center (NCSC), FBI
The "reasonable measures" that make IP a trade secret in court.
Confidentiality and invention assignment · DTSA whistleblower immunity notice · Documented "reasonable measures" · Playbook for suspected IP theft
Guidance: US Code (LII), US Code (LII), US Code (LII)
How the score works
Exposure (0 to 100) comes from your profile: how attractive the sector is to espionage (our rating), how many kinds of crown-jewel information you hold, operations or partners abroad, travel with devices, remote work and recent turnover. Control readiness (0 to 100) comes from your answers: each control has four maturity levels and a weight from 1 to 5 that we set from the guidance below, raised where your profile makes it matter more (for example departure controls after layoffs, travel controls when staff travel). Residual risk blends the two: 45% exposure, 55% control gaps. The weights are PlayCISO's judgement; no agency publishes a numeric scheme.
For the full picture of how espionage cases unfold, read corporate espionage explained, then rehearse the response in the Insider Data Theft Lab.
Frequently asked questions
What is corporate espionage?
Corporate or industrial espionage is the theft of trade secrets and other confidential business information for a competitor's or a foreign state's advantage. In the US, stealing a trade secret to benefit a foreign government, instrumentality or agent is economic espionage under 18 U.S.C. 1831; stealing it for anyone else's economic benefit is theft of trade secrets under 1832. The FBI notes that cases opened as economic espionage are often charged as theft of trade secrets because the foreign link is hard to prove.
What is the difference between corporate espionage and industrial espionage?
In everyday use they mean the same thing: covert collection of a company's confidential information. "Industrial espionage" is the older term, often used for manufacturing and technology; "corporate espionage" is broader. Neither is a legal term in the US; the offences are economic espionage and theft of trade secrets.
How do insiders steal trade secrets?
Usually with access they already have: downloading repositories, syncing files to personal cloud storage, copying to USB, emailing documents to personal accounts, printing, or photographing screens. Approaches can come from competitors or foreign recruiters, sometimes through job offers or consulting. CERT and CISA both treat departing employees as a high-risk group, which is why the scorecard weighs departure controls heavily.
What are "reasonable measures" to protect a trade secret?
18 U.S.C. 1839(3) requires the owner to have taken reasonable measures to keep the information secret. Courts look at things like confidentiality agreements, need-to-know access, marking, physical and IT security, training and exit procedures. The FBI's reporting checklist asks victims about the same controls, so keep evidence of each.
What is the DTSA whistleblower notice?
Under 18 U.S.C. 1833(b), an employer must give notice of whistleblower immunity in any contract or agreement with an employee that governs trade secrets or confidential information. Without it, the employer cannot recover exemplary damages or attorney fees under the Defend Trade Secrets Act against an employee bound by an agreement entered into or updated after 11 May 2016. Ask counsel to check your templates.
Is this scorecard an insider threat assessment?
It is a self-assessment of your controls against public guidance, useful to find gaps and plan work. It does not investigate any person and should never be used to profile individuals. Any suspected case needs HR and legal involvement, and evidence handled carefully.
Sources
- CISA: Insider Threat Mitigation Guide (updated edition) (Sep 2026). Updated edition of CISA's guide to building an insider threat mitigation program; adds guidance on hybrid and remote work, AI used to manipulate or deceive, access control, visitor screening and reducing the risk of adverse employee separations.
- CISA: Insider Threat Mitigation Guide (original edition, PDF) (Nov 2020). Frames insider threat mitigation as Define, Detect and Identify, Assess, and Manage, run by a multidisciplinary team (security, HR, legal, IT, leadership) with clear reporting channels and a focus on behaviour, not just technology.
- US National Counterintelligence and Security Center (NCSC): Insider Threat Mitigation for U.S. Critical Infrastructure Entities: Guidelines from an Intelligence Perspective (23 Mar 2021). Guidance on building insider threat into organisational risk management, written with foreign intelligence targeting of insiders in mind.
- FBI: The Insider Threat: An Introduction to Detecting and Deterring an Insider Spy (brochure, read 31 Oct 2026). An introduction for managers and security staff on spotting insiders who steal for a competitor or a foreign government, with tips on protecting trade secrets.
- FBI: Checklist for Reporting an Economic Espionage or Theft of Trade Secrets Offense (checklist, read 31 Oct 2026). What the FBI asks a victim company for when reporting: a description of the trade secret and its estimated value, and the physical, computer, document-control, confidentiality-agreement and employee controls (including exit interviews) used to protect it. A ready-made list of evidence to keep before you need it.
- Carnegie Mellon SEI (CERT): Common Sense Guide to Mitigating Insider Threats, Seventh Edition (7 Sep 2022). 22 best practices drawn from CERT's insider incident research, including knowing and protecting critical assets, least privilege and account management, monitoring remote access, baselining normal behaviour, closing the doors to data exfiltration, and thorough termination procedures.
- US Code (LII): 18 U.S.C. 1831: Economic espionage (current text). Theft of a trade secret intending or knowing it will benefit a foreign government, foreign instrumentality or foreign agent.
- US Code (LII): 18 U.S.C. 1832: Theft of trade secrets (current text). Theft of a trade secret related to a product or service in interstate or foreign commerce, to the economic benefit of anyone other than the owner. Most corporate cases are charged under this section.
- US Code (LII): 18 U.S.C. 1833(b): Immunity and the whistleblower notice (current text). An employer must give notice of whistleblower immunity in any contract or agreement with an employee that governs trade secrets (entered into or updated after 11 May 2016), or it cannot recover exemplary damages or attorney fees from that employee under the Defend Trade Secrets Act.
- US Code (LII): 18 U.S.C. 1839(3): Definition of trade secret (current text). Information is a trade secret only if the owner "has taken reasonable measures to keep such information secret" and it derives value from not being generally known. No reasonable measures, no trade secret.
Educational self-assessment, not legal advice. Do not use it to profile individuals. Involve HR and counsel before acting on a suspected insider, and follow local employment and privacy law on monitoring.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.