An insider threat risk or vulnerability assessment often begins with a question: “What, if any, threats exist that could potentially lead to problems in the workplace?” Focusing immediately on technical factors such as information technology and physical security threats can be easy.