Everyone on a SCIF or SAPF project has a favorite part of security: the CSP and CST oversight, the perimeter, the TSCM sweep, the alarm system, OPSEC, or personnel vetting. Each layer exists because the others can't do its job. Here's what each one actually catches, why the insider threat walks through all of them, and where the real gaps hide on most projects.