The playbook for this kind of threat has changed in the modern era, but it’s important to note the two different approaches. The first is private competitors, which are companies that want to steal your intellectual property (IP), sabotage your product roadmap, recruit your key talent, or find out where the bodies are buried so they can slow you down. The second is nation-states: friends, frenemies, and adversaries doing the same work on behalf of their state-owned industries or the commercial interests of their country.

But who they’re targeting is different. They want to get to whoever they can have the most impact on. The more your business matters to your industry, your country, or the world, the more target-rich you become. This might be AI companies rewriting how the world works, defense contractors and manufacturers, or IP-rich industries like movie studios. 

The size of the company matters less than you’d think, too. A multibillion-dollar pharma company churning out generics is far less interesting to an adversary than the smaller company that just developed a new GLP-1. And they might be a tougher target, too. The uncomfortable truth is that if you’ve built something the world wants, someone wants to take it. 

And all of this has happened before: 

• The theft of Kodak film secrets by Harold Worden in the 1990s
• The IBM/Hitachi case in the 1980s
• A developer convicted in Germany for stealing trade secrets from Valeo, allegedly to benefit NVIDIA’s parking-assistance work
• A Chinese national charged with taking more than 500 confidential AI files from Google 
• A former Coca-Cola employee convicted over stolen chemical formulas sold to rivals
• Tesla suing Rivian over poached employees and proprietary battery technology

These cases fall under the same corporate espionage umbrella, putting the emphasis on security teams to play a pivotal role in thwarting these threats. 

The Old Tricks Are the New Tricks

Here’s what security leaders should know: the fundamentals of espionage haven’t evolved much. They include things like human intelligence and recruitment campaigns, tech-based interception (some of us might know this as signals intelligence) like malicious code that’s slipped into systems, or a hack that allows sensitive work walking out the door. There are other categories of tricks, but when we think about corporate espionage, these are the two that come up most frequently. 

What has evolved is the delivery of the threats.

AI now lets a bad actor believably transform their appearance, language, and mannerisms, allowing them to tailor exactly how they approach a target. The LinkedIn message from a “recruiter” asking oddly specific questions about your work is the new stranger at the conference. Sophisticated phishing campaigns have replaced scattering USB sticks in the parking lot and hoping someone helpfully plugs one in. And where spies once smuggled in a camera to photograph documents, cloud infrastructure has made exfiltrating data extremely easy (although it’s also made monitoring and catching it easier, if anyone’s actually watching).

Then there’s the threat that would’ve sounded absurd five years ago: companies unknowingly hiring North Korean IT workers, such as remote employees who interview well, work competently, and happen to be sitting in Pyongyang. This example isn’t hypothetical. It’s federal case law. 

The insider threat isn't just the disgruntled employee anymore. Sometimes the insider was never really your employee at all.

How Businesses Actually Protect Themselves

Here’s where a lot of organizations get this wrong: they treat espionage risk as everyone’s job, which in practice means it’s no one’s job. This might look like phishing reports that go to an IT helpdesk, data loss prevention (DLP) alerts that pile up unread, or travel security protocols in a PDF nobody opens.

Without question, the best investment a business can make is a function-specific threat team. This looks different at every company, but the spirit is the same: threat awareness, training, detection, and mitigation need to be somebody’s primary function, not their second or third hat.

In actuality, this means a few things happen:

• Travelers get real briefings. Employees heading abroad learn what they might actually encounter, including things like elicitation attempts, device tampering, or the too-friendly contact at a conference, not a generic checklist to skim on the plane.
• Alerts route to an owner. Phishing attempts and DLP alerts go to someone whose actual job is to connect the dots, and not a ticket queue where they go unread or unaddressed.
• Hiring gets a second look. Remote candidates are verified as real people in real places, with a team that conducts identity checks, live interviews, and monitors hardware shipping addresses that make sense so the new hire isn’t logging in from somewhere they shouldn’t be.
• Access follows the employee lifecycle. When people change roles or leave, their access to sensitive systems and spaces changes with them. Departing employees are the single most common exfiltration point, and offboarding is where it gets caught (or doesn’t). Regular reviews and the Principle of Least Privilege can go a long way.
• The program gets rehearsed. Mature organizations run tabletop exercises against realistic scenarios, so the first time the team works an insider case isn’t during a real one.
• A full insider threat program ties it together. The most advanced companies proactively watch for indicators of intrusion, elevated risk, and behavior that doesn’t add up, across both digital and physical environments.

That last part matters. Espionage doesn’t respect the org chart split between cyber and physical security. The person uploading files to the cloud also badges into the building. The signals are present in the form of badge data, access anomalies, unusual hours, and alerts that individually look like noise. The organizations that catch insiders are the ones that bring those signals together and put a dedicated team in front of them.

The fix here to catch these threats isn’t another dashboard. It’s a program: ownership, training, and detection working as a single function.

Corporate espionage is older than the corporation. It’s not going away, and the tools aimed at your IP are only getting better and more sophisticated. The question isn’t whether your business is a target. If your work matters, it is. The question is whether protecting it is somebody’s actual job, or just something everyone assumes someone else is handling.