The operative we hired: inside a North Korean fraud cell, with Ryan LaSalle, Nisos

Insider incidents have steadily increased in recent years, but there's one threat that's causing particular concern: North Korean operatives posing as remote IT workers, quietly embedded inside legitimate organisations. In this episode, Valeska and co-host Sonia Millen are joined by Ryan LaSalle, CEO of Nisos, a US-based human risk intelligence firm specialising in insider threats, employment fraud and executive digital risk. Ryan shares the extraordinary story of how Nisos uncovered and infiltrated a North Korean remote IT worker fraud operation after a suspected operative applied for a role at the company, ultimately exposing a network of more than 20 workers employed across multiple US organisations. Ryan explains how these operations work, the warning signs organisations should look for throughout the hiring and employment lifecycle, and why remote work has created new opportunities for nation-state actors and organised crime groups.

Resources from this episode:

Defending from within: a guide to insider threat management

Advisory note – DPRK information technology workers, 31 July 2026.

Joint statement on DPRK IT workers | Australian Government Department of Foreign Affairs and Trade, 31 July 2026.

Cyber risks of DPRK IT Workers, 6 November 2025.

Exposing DPRK Employment Fraud Operations and People, Process, Personas: Nisos Exposes the Human Risk in DPRK Employment Fraud Schemes

Ryan's book recommendations: This is How They Tell Me the World Ends by Nicole Perlroth, Snow Crash by Neal Stephenson and Cryptonomicon by Neal Stephenson.