MICE

MICE is a mnemonic for the four most common reasons why a person passes on secrets belonging to their employer or their country. The four letters stand for the English words: Money, Ideology, Coercion, and Ego. The scheme originally comes from the work of intelligence agencies, who used it to assess how someone could be recruited. Today, companies also use this framework to evaluate threats posed by their own people. This refers to individuals who have legitimate access to sensitive data and abuse it.

Why insider attackers are so dangerous

Most attention in IT security is focused on attacks from outside. Firewalls, antivirus scanners, and passwords are meant to keep strangers out. However, an employee with valid access effortlessly bypasses all these protective walls. They don’t need to hack anything, since they’re allowed to see the data anyway. That’s exactly why such cases often go undetected for months.

For companies, this is a tangible economic risk. If design plans, customer lists, or software source code leak out, a company loses its technical edge. For publicly traded companies, such an incident can move the stock price. Data protection authorities can additionally impose fines if customer data is affected.

MICE helps because it shifts the discussion from technology to people. A security concept consisting only of software has a major gap. Anyone who knows the typical motives can counteract earlier. This ranges from fair pay to support contacts for employees in financial distress.

The four letters in detail

Money simply means payment. Someone sells information because they’re in debt or greedy. Ideology describes an inner conviction. The person considers the betrayal morally right, for example because they want to expose wrongdoing or feel aligned with another state.

Coercion means compulsion. The person is blackmailed with a secret or pressured with threats against their family. Ego stands for vanity and being slighted. Anyone who feels overlooked, passed over for a promotion, or underestimated sometimes seeks validation outside the company.

In practice, the motives rarely act alone. A slighted employee is more easily lured with money because they’ve already withdrawn their loyalty internally. Some experts therefore extend the acronym to MICE-RC, adding revenge and thrill-seeking. It’s also important to draw a distinction: MICE describes intentional action. The far more common case is carelessness, such as a misaddressed attachment. The model doesn’t explain such mishaps.

MICE in security reports and everyday work

The term appears mainly in technical texts about insider threats, meaning dangers from within an organization’s own ranks. Security firms publish annual reports in which they categorize incidents according to these motives. The framework is also frequently cited in reports on economic espionage or leaked documents. Journalists use it to explain why someone leaked internal information to the press.

In the everyday operations of large companies, MICE is rarely mentioned openly, but it operates in the background. Security screenings for new hires ask about financial circumstances. Access rights are tightly restricted so that no one sees more than necessary. When an employee leaves, accounts are immediately locked.

For the AI industry, this topic carries particular weight. The weights of a large language model are a single file, essentially a lab’s most valuable asset in compact form. A single employee with access could walk away with years of expensive research. This is exactly why several AI companies now write extensively about their safeguards against insiders.