Ooooooooh, minty!

Mint flavouring ranks highly among most people. In fact, it is the 7th favourite ice-cream flavour (said he, without knowing what the higher favourites are, but I figure chocolate is there or thereabouts).

If I offer you mint tea or chocolate mint ice cream in the weather we have been having, you are unlikely to decline. You are sitting in the stifling heat of a train station, the smells of diesel and doughnuts wafting around you and, by God, something cool would be nice.

“Hey, sorry to interrupt your thoughts, but the guy in the ice-cream van just gave me two cups of mint ice cream instead of one. Would you take it, please? I can’t eat two.” A soft voice, neither cold nor confident. A nervous smile, showing hope, not expectation, and a need for you to take the ice cream before it melts into a puddle.”

You consider.

“Hey, they say mint is the world’s favourite flavour.”

“Thank you,” you say, taking it. “You are very kind. Chocolate is the world’s favourite,” you offer with a smile.

“It isn’t, is it?”

“I’d know; I work for Super Icey Ice Cream.” 

“Really? You know, and it is a small world. I read in Ice Cream Times recently that you guys have the third-best delivery system for ice cream in the world.”

“We did, but our new delivery system being released next month is going to push us to the number one spot.” 

“Number one spot?” “Yes indeed, we are going to wipe the floor with Squidgy Ice Cream and Lickety-Split Ice Cream.”

“Well, good for you guys. Best of luck with that, and maybe, if we meet again, you can buy me one!”

“That’s a deal. Take care.”

And off goes the commercial intelligence in exchange for a free ice cream.

That is the mint that really matters in this conversation. That is HUMINT, human intelligence.

Yes, HUMINT is one of the sexier intelligence-gathering techniques because it is what people do best, i.e face-to-face. It does not rely on high-tech, and it is not impeded by cloud cover or electronic jamming. And while the latest thingamajig for the whatyamacallit (or the specs for the engine capabilities for the new F-47 fighter jet as a fine example) are the pinnacle of intelligence gathering, start-ups and SMEs are not too small to be targets.

As above, HUMINT gathering against a company is often cheap and opportunistic. In the ice cream scenario, an investment analyst sees a hot and bothered employee of a company they are tracking and uses elicitation to get a quick kill. The touchpoints are barely noticeable: a conference conversation, a LinkedIn message, and a “friendly” recurring vendor contact are all innocuous until they are not. Smaller organisations tend to have the least formal security simply because they are formed around security cultures based on approachability. The company is moving fast, pivoting every few months and focused on success, while staff remain under-briefed. The same tradecraft used to recruit informants and elicit information from suspects and sources works just as well against a founder at a networking event. It is rapport-building, motivation exploitation and non-coercive elicitation that gets the inside track on what you are doing, when you are doing it and with whom you are doing it to/with/for.

So, apart from declining every ice cream and every offer that seems friendly, what can small businesses do to protect themselves from evil ice cream? There is, would you believe, a checklist!

The core insight from HUMINT tradecraft is that people, not systems, are the path of least resistance. A commercially viable target is recruited through elicitation, building a realistic relationship through rapport-based interactions and asking for very little.

1. Map your human attack surface. It sounds horrible, doesn’t it, but it is the reality of what you are dealing with. Identify those who have sensitive knowledge and treat them as a prioritised group – these are your founders, engineers with source code/IP access, finance staff with banking access, executive assistants who have C-suite access and similar employees.

2. Everyone by now knows phishing; how about elicitation? It is such a wonderfully simple concept: it works by building rapport and inviting a person to confirm, correct, or elaborate on something rather than asking a direct question they’d think twice about answering.

3. Watch for the recruitment pattern in new relationships. In other words, flattery. Look for a personal investment of time and warmth that seems unusual in the context.

4. Know your own people’s pressure points. Like in banking’s KYC, employers ought to know their employees, at least those who will be targeted. Do they feel financial strain, marital issues, substance dependencies or something simple like recognition needs? Remember, rapport is used to build relationships, not to threaten or coerce. There will be no black-and-white pictures in a brown envelope. Instead, it is “Ah man, the same thing happened to me last year.”

5. Access by need, not by seniority. If it is company-critical data, control access to those who need it, not those who have seniority.

6. Treat offboarding as a security event. Assume the worst. The possibility of hostility, not carelessness, ought to be uppermost in the mind of the security team. Access revocation, device/data return, and a clear, forceful confidentiality reminder, especially in high-knowledge-access roles, are important.

7. Vet before you trust. If a new relationship comes with access implications, then a proportionate level of due diligence is required. It sounds terrible, doesn’t it (again), but the word is “proportionate”, and it is not intrusive. You are, in fact, auditing yourself and not the pleasant person sitting opposite you on the train who is trying to strike up a conversation.

8. Signpost the safe place clearly. Fear of looking stupid or paranoid often prevents people from reporting concerns. Reporting that “someone is asking me odd questions” is not something we are wired to do, but it is necessary, and there has to be a person, unit or system for this kind of activity to be reported to.

9. Small is not a defence. Vigilance should be proportionate to the risk, but the assumption that “we are too small to be worth it” is itself a vulnerability that can be exploited by those who seek to gain.

HUMINT is only one flavour in the ice cream parlour of intelligence. It just happens to be my favourite flavour.

Here is a quick experiment before you go. You are senior enough that people already treat what you say as more than idle chat – a founder, maybe, or close enough to the top that your name is on the website. You have thought about insider risk, but it is the abstract kind that is “on the list” rather than actually built. There is always something more urgent between the roadmap and the board deck. When you consider it coldly, the thing that actually worries you at 2 am isn’t a stranger cold-messaging you on LinkedIn; it is someone already inside the tent, someone trusted, who has been around long enough to know more than they probably should.

Close? Notice what just happened. Not a single question. I told you what you think, confidently enough that you either nodded along or started mentally correcting me. Either way, you just told me something I didn’t know thirty seconds ago. That is elicitation. It does not feel like interrogation. It feels like being understood.

Enjoy the ice cream.