The Security Perimeter Was Not Breached
On 30 September 2026, flydubai flight FZ1073 departed Dubai for Tel Aviv with a threat already inside its most protected environment.
According to the UAE Attorney-General’s account of the continuing investigation, the aircraft’s Omani co-pilot attacked the captain inside the cockpit with an emergency axe and attempted to seize control of the aircraft. Another pilot travelling on board became suspicious when the cockpit door opened and closed repeatedly, entered using the access code and intervened with a cabin crew member and passengers. A relief captain and co-pilot regained control, diverted the aircraft and landed safely at Tabuk Airport in Saudi Arabia.
The Public Prosecution stated on 9 October that the attack formed part of a premeditated plan to use the aircraft in a suicide attack against the passenger terminal at Ben Gurion Airport. It also said the suspect had operated two previous Tel Aviv flights to familiarise himself with the route and airport before beginning to execute the plot on his third.
The incident is exceptional in its potential consequence. The security problem it exposes is not.
No outsider defeated passenger screening. No prohibited weapon was smuggled through the airport. No unauthorised person forced the cockpit door. The alleged attacker held the licence, position and operational access required to be inside the flight deck, and the implement reportedly used was emergency equipment kept there.
The perimeter worked against the wrong threat.
What the Investigation Does and Does Not Establish
The distinction matters because the early public discussion has tended towards one of two inadequate conclusions: either that the incident proves a specific employer failed to conduct checks, or that no reasonable screening process could have identified the risk and therefore nothing material can change.
The evidence currently supports neither position.
The UAE Attorney-General stated that flydubai’s recruitment procedures were examined and that the co-pilot had met the professional and security requirements for employment. He held a pilot’s licence, produced a certificate of good conduct and completed the required checks. None of those procedures revealed indications of extremist views or an intention to carry out a terrorist plot.
Separately, the Associated Press reported, citing unnamed officials and people familiar with the matter, that Oman Air had previously barred the individual from flying because of concerns that he had adopted extremist views and moved him to an administrative role. AP also recorded that Oman Air and the Omani government had not publicly confirmed those allegations. No public evidence reviewed for this paper establishes that flydubai knew of such a concern, that it was available through an ordinary criminal or security check, or that a former employer was legally able or willing to disclose it.
Those qualifications are essential. A serious insider-risk analysis cannot replace one form of superficial screening with superficial judgment after an event.
The defensible conclusion is narrower and more useful. Formal eligibility checks can be completed and still leave material questions unanswered. A good-conduct certificate is evidence about recorded criminal status within the scope of the issuing system. A licence establishes professional authorisation. Neither explains why a safety-critical employee left a previous flying role, whether duties changed before departure, what concerns were raised internally, or whether the account provided by the candidate is consistent with independently obtained information.
That is the space between employment screening and employment due diligence.
Insider Threat Is an Access Problem
An insider threat is commonly misunderstood as a dishonest employee stealing data or money. That is one category, but not the definition.
CISA defines the threat as the potential for a person to use authorised access or organisational knowledge to cause harm, intentionally or unintentionally, to people, facilities, information, equipment, networks or systems. The relevant population therefore includes employees, directors, contractors, secondees, service providers and former personnel whose access or knowledge persists beyond their formal relationship with the organisation.
The possible harm is equally broad: fraud, theft, corruption, sabotage, espionage, unauthorised disclosure, workplace violence, facilitation of an external actor, negligent compromise and ideologically motivated violence. What connects these acts is not motive. It is access.
This makes insider risk structurally different from conventional perimeter security. External controls ask whether a person is authorised to enter a system, building, account or decision process. Insider-risk controls ask whether that authorisation remains appropriate, whether the person’s conduct is consistent with the trust placed in them, and whether the organisation can detect and respond when relevant circumstances change.
The first access-control decision is recruitment.
Where Conventional Screening Stops
Most employer screening programmes answer administrative questions. Is the identity document valid? Does the candidate have the claimed qualification? Is there a recorded criminal conviction? Does the name appear on a sanctions or adverse-media database? Did the supplied referees confirm employment?
Those checks are necessary. They are not an investigation.
A database can report information that has been published, indexed and correctly associated with the subject. It cannot report a concern that remained inside a former employer, a disciplinary issue resolved without public proceedings, an unexplained operational reassignment, or a reputation known within a professional community but never recorded in open sources. Candidate-nominated references are particularly limited because the candidate controls the selection and can exclude precisely the person most capable of explaining the relevant period.
Cross-border careers make the gap wider. Records are fragmented by jurisdiction, privacy law, language, institutional practice and the willingness of former employers to speak. A “clear” result may mean that no adverse information exists. It may also mean that the source checked did not hold it, could not disclose it, was not searched in the relevant language or was never contacted.
Employment due diligence begins where this ambiguity becomes material. Its purpose is not to prove that a candidate is safe; no credible process can provide that assurance. Its purpose is to test whether the professional history is coherent, independently corroborated and proportionate to the access the role will confer.
For a high-consequence appointment, that process should include verification of the complete employment chronology; explanation of gaps, abrupt departures and material changes in responsibility; direct contact with former employers through independently sourced details; qualification and licence verification with issuing bodies; litigation, regulatory and adverse-media research across relevant jurisdictions and languages; proportionate open-source assessment; and structured reference interviews designed to test conduct, judgment, reliability and the circumstances of departure rather than simply confirm dates.
The distinction is methodological. A reference check asks, “Did this person work here?” A due diligence interview asks, “What responsibility did this person actually hold, how did their access change, why did they leave, and is there anything in the documented account that requires further corroboration?”
Employment Due Diligence Is the Foundation, Not the Programme
Even the strongest pre-employment investigation is a point-in-time assessment. Insider risk is dynamic.
People develop financial pressures, grievances, external relationships, health problems, ideological commitments or divided loyalties after joining an organisation. Responsibilities expand. Access accumulates. A person originally hired into a low-risk role may move into a function with authority over payments, sensitive data, safety systems or vulnerable individuals without the original screening ever being revisited.
ICAO’s Insider Threat Toolkit reflects this directly. It describes checks of identity, previous work experience, criminal history and educational background as a cornerstone of insider-threat mitigation, but also calls for recurrent background checks and continuous vetting, including cooperation with authorities in other states where relevant. Its stated rationale is that individuals may acquire harmful intent after employment and that management may already have observed disciplinary or performance concerns that should inform reassessment.
The UK National Protective Security Authority makes the same lifecycle distinction. Its personnel-security model comprises governance and leadership, insider-risk assessment, pre-employment screening, ongoing personnel security, monitoring and assessment, investigation and disciplinary response, and security culture and behaviour change. Carnegie Mellon’s CERT programme likewise warns that technology alone is not an insider-risk programme; effective governance requires participation by HR, legal, risk, physical security, information security and operational management, supported by confidential reporting and a defined incident-response process.
The implication is operational. Pre-employment due diligence should establish the baseline against which later change can be evaluated. It should record what was verified, what could not be verified, what residual uncertainty remained and what access conditions or review points follow from that uncertainty. Without that baseline, continuous monitoring becomes an accumulation of isolated alerts without context.
What a Robust Programme Requires
A credible insider-threat programme is neither universal surveillance nor a security label attached to an HR policy. It is a risk-governance system built around the organisation’s critical assets and the roles capable of affecting them.
The programme begins by identifying what must be protected: funds, customer information, intellectual property, operational systems, physical infrastructure, safety-critical functions, vulnerable people and decision authority. It then maps the roles that can reach those assets, including contractors and third-party personnel, and grades the consequence of misuse. Screening and monitoring should follow the role risk, not seniority or job title alone.
It also requires shared governance. HR may hold information about unexplained absence, conflict or disciplinary history. Information security may detect abnormal data access. Finance may observe unusual transaction behaviour. Physical security may see access outside ordinary patterns. Line managers may notice deteriorating performance, fixation, threats or significant behavioural change. None of those functions can assess insider risk effectively if each holds its evidence in a separate silo.
A multidisciplinary assessment mechanism should receive concerns, distinguish welfare or performance issues from potential security risk, document decisions and apply proportionate interventions. Those interventions may include employee support, adjustment of duties, additional supervision, access restriction, investigation, legal review or referral to competent authorities. Confidential reporting must protect legitimate whistleblowers and avoid turning ordinary workplace disagreement into a security allegation.
Technical controls remain important. Least-privilege access, separation of duties, privileged-account governance, audit logs, data-loss prevention and rapid joiner-mover-leaver procedures reduce the opportunity available to any one person. They do not replace personnel security. They limit the damage when personnel security does not identify intent in time.
The programme must also be lawful and transparent. The UAE’s Personal Data Protection Law governs electronic processing of personal information, restricts processing without consent except where a lawful exception applies, and establishes duties concerning security, individual rights and cross-border transfers. Employment screening, open-source review and ongoing monitoring therefore require a defined purpose, proportionality, appropriate notice or other lawful basis, access controls, retention rules and legal review. A programme that treats privacy as an obstacle will generate mistrust and legal exposure. A programme that treats it as a design requirement is more likely to produce reliable reporting and defensible decisions.
Practitioner Implications
For boards, security leaders, general counsel, compliance functions and HR directors, the FZ1073 case supports six immediate conclusions.
— Define high-consequence roles before defining checks. Identify positions with access to safety-critical systems, substantial funds, sensitive data, executive movements, critical infrastructure or unilateral decision authority. Apply enhanced employment due diligence to the exposure created by the role, including contractors and internal transfers, not only permanent new hires.
— Verify the employment narrative, not only the dates. Independently establish the candidate’s actual duties, changes in status, reasons for departure and eligibility for rehire. A transition from operational to administrative duties, unexplained loss of responsibility, short tenure or unsuccessful pre-employment training should trigger a documented enquiry, not an assumption.
— Distinguish certificates from corroboration. A good-conduct certificate, licence, degree or database result answers a defined question. Record what jurisdiction, period and conduct it covers, and what remains outside its scope. “Clear” must never be allowed to mean “fully understood.”
— Create a reviewable baseline. The employment due diligence file should identify verified facts, discrepancies, unresolved gaps, source limitations, residual risk and the rationale for the hiring decision. Those findings should inform probation, access rights, supervision and the timing of reassessment.
— Continue assessment after hiring. Re-screen at risk-based intervals and at material trigger events, including promotion, transfer into a sensitive role, substantial expansion of access, unexplained conduct concerns or credible new information. ICAO specifically recommends recurrent checks and continuous vetting because risk may emerge after employment.
— Build reporting and response before an alert occurs. Employees need a trusted mechanism for raising concerns, and the organisation needs a multidisciplinary process for assessing them. Reporting without triage creates noise. Monitoring without governance creates surveillance. An effective programme connects information to a proportionate, documented decision.
Trust Must Be Governed
The most important fact about FZ1073 is not simply that an individual allegedly intended harm. It is that his employment gave him the position, knowledge and access through which that intent could become operational.
That does not mean an employer can predict every act of violence, identify every concealed belief or eliminate insider risk through deeper screening. It cannot. Nor does the present public record establish that a particular additional check would have prevented this incident.
It establishes something more durable: compliance with a hiring procedure and control of insider risk are not the same thing.
Employment due diligence is the first opportunity to test the history, judgment and credibility of a person before institutional access is granted. Continuous personnel security is the mechanism for recognising that people, circumstances and access change after the contract is signed. Reporting, access governance and response are what prevent individual warning signs from remaining isolated inside an organisation.
A robust insider-threat programme does not begin from the premise that employees are untrustworthy. It begins from the recognition that trust creates access, access creates exposure, and exposure has to be governed.
The question for employers is no longer whether the person has passed the required checks. It is whether the organisation has built a defensible basis for trust—and whether it will know when that basis changes.