Research security is usually discussed as an institutional problem—a matter of governance, systems, and policy settings. But institutions do not conduct research; people do. And the people most exposed to the consequences of how we design research security are those least equipped to push back: higher degree research (HDR) students and early career researchers (ECRs) navigating the formative stages of a research life.
HDR students and ECRs are already experiencing the effects of security settings, even if the underlying rationale has not been explained to them. Projects are quietly reshaped during scoping to avoid scrutiny. Well-meaning supervisors and mentors steer emerging researchers away from collaborations that might attract delay or complexity. Visa processing times silently filter who arrives and when. HDRs and ECRs—particularly, though not exclusively, those from countries subject to heightened security attention—find their topics narrowed, their access to facilities conditional, their professional networks treated as latent risk. The intent may be threat-based rather than nationality-based, but the experience does not always reflect that distinction. None of this is necessarily wrong, but is all of it made legible to the people it affects?
The result is a generation of researchers being trained not in security literacy, but in ambient caution. They learn to read unspoken signals about what is permissible. They internalise risk aversion without ever being given the language or framework to distinguish genuine concern from institutional anxiety. This is not research security; it is the shadow curriculum of a system that has so far failed to systemically integrate security into research(er) development with the same deliberateness it brings to ethics, methodology, or academic integrity.
The distinction matters. A researcher trained in security literacy understands why certain protections exist, can make proportionate judgements about data sharing and collaboration, and moves through their career—whether in academia, industry, or government—with the confidence to navigate complex environments. A researcher trained in caution learns avoidance. They produce less ambitious work, build narrower networks, and carry habits of self-censorship into careers where judgement is what the nation requires.
For ECRs, the stakes carry weight. These are researchers at the precise moment when international networks are built, when collaborative habits are formed, and when career trajectories are set. An ECR who learns early that international engagement is a source of institutional friction rather than professional opportunity will calibrate accordingly, perhaps even permanently. The system risks losing not just a single collaboration, but the compound returns of a career built on global connectivity.
Supervisors and research leaders bear a disproportionate share of this burden. In the absence of clear institutional guidance, they become de facto security decision-makers—reshaping projects, limiting partnerships, managing expectations—often without training, support, or even acknowledgement that this is what they are doing. Many do so thoughtfully and well. The problem is not supervisor capability; it is a system that depends on individual discretion without investing in the conditions that make discretion reliable. The supervisory relationship and the mentoring of ECRs, already stretched by workload pressures and shifting career structures, now quietly absorb a risk-management function they were never designed to carry.
Talent mobility compounds the challenge. Australia's research system depends on international HDR students and ECRs not for enrolment revenue or affordable labour, but for capability. In fields from quantum science to biotechnology, the pipeline of skilled researchers is irreducibly global. Yet mobility policy, including visa settings, security assessments, and foreign interference frameworks, operates largely as a screening mechanism, selecting against risk rather than selecting for capability. When mobility policy functions as de facto workforce policy without being acknowledged as such, the system cannot make coherent decisions about the talent it needs and the talent it is turning away.
Let’s be clear, screening is legitimate; some risks are real and warrant serious management. But design failures carry costs that accumulate quietly. These costs come with every HDR who abandons a project mid-stream because a collaboration became untenable, every ECR who stops pursuing international partnerships because the approvals process is unpredictable, every talented researcher who chooses another country's system because Australia's felt opaque. They are capability losses that no compliance report will capture.
The case for deliberate design is strengthened by the seriousness of sovereign risk. Australia needs researchers who can work confidently at the boundary of sensitive and contested knowledge domains, not researchers who have learned only to avoid them. A system that fails to adequately develop security-literate HDR students and ECRs does not just produce cautious individuals, but a workforce unable to fully contribute to the national capability it is meant to protect. The pipeline of researchers capable of working in classified, dual-use, or strategically sensitive fields depends on training systems that build towards engagement with complexity, not retreat from it.
What does deliberate design look like? It means treating security as a core component of research and researcher development, and a capability built progressively from candidature through early career – rather than a compliance induction in orientation week. It means equipping supervisors and research leaders with frameworks and support rather than silent responsibility. It means making the logic of security settings transparent to emerging researchers, so they can engage as informed participants rather than passive subjects of decisions made elsewhere. For most, this is a work in progress.
If institutions shape security through design, and research training embeds it culturally, the final test is whether Australia can still collaborate with the world without losing the trust, or the talent, on which its research future depends.
Dr Ross McLennan is PVC (Research Services) at Macquarie University.