Because their access is still valid but their trust relationship has changed. That creates a period where they can legitimately work while also having the greatest incentive to remove material before access is closed. Offboarding therefore needs tighter policy, faster review and narrower movement rights than normal employment.
Why the exfiltration window gets wider during offboarding
Departing employees are risky because they sit in a narrow but dangerous overlap: their access is still live, their knowledge of where sensitive material lives is still current, and their incentives can change quickly. That makes the offboarding period less about ordinary insider behaviour and more about a temporary mismatch between authority, intent and control.
The practical difference from a steady-state user is timing. A current employee usually has ongoing business accountability and a stable need-to-know profile. A leaver may still be able to browse, copy, sync, download or forward material while anticipating loss of access, which is why offboarding has to reduce opportunity before the relationship fully breaks.
That also changes what counts as suspicious. A large export, unusual file access, mailbox forwarding rule, bulk cloud sync or last-minute permission change can all be normal on their own, but they become more meaningful when the user has announced departure or is already in notice. The same behaviour is lower risk when the person still has an ongoing role and future access need.
Why trust change matters more than access change alone
exfiltration risk rises when the trust relationship changes faster than the access model does. The employee still appears legitimate to systems and colleagues, yet the organisation can no longer assume their incentives are aligned with preserving confidentiality. That is why leaver risk is not just an access problem, it is an access-plus-judgement problem.
This is where insider-threat controls become especially relevant. Insider Threat and Identity Guide is useful here because leaver handling depends on least privilege, privileged monitoring, behavioural signals and fast removal of unnecessary movement rights. The core issue is not whether the employee remains “trusted” in a personal sense, but whether the environment still gives them enough reach to remove material at speed.
In practice, the highest-risk leavers are those with broad access, unusual knowledge of where high-value data resides, or the ability to move laterally across business units, SaaS platforms, email, code repositories or file stores. The more places they can reach before access is cut, the easier it is to assemble a complete copy of something sensitive.
What offboarding needs to change before the employee leaves
Effective offboarding treats departure as a control-state change, not just an HR event. Access review should start as soon as notice is given, and the scope should be narrower than steady-state review because the goal is to shrink the blast radius while legitimate work is still allowed to continue.
What to prioritise: remove unnecessary permissions first, especially broad read access, forwarding paths, shared mailbox access, external sync rights and any privilege that enables bulk copying or lateral movement. Delay is the enemy here, because a valid account with a changed motive is the exact condition that creates the window.
What to verify: confirm that the leaver’s access, sessions, tokens, device trust and delegation paths are all covered, not just the primary login. A common mistake is to revoke the visible account while leaving other access paths active long enough for exfiltration to continue.
What good looks like: the employee can still complete handover tasks, but cannot freely discover, aggregate or export material outside the scope of those tasks. That means the organisation has separated continuation of work from continuation of reach.
Risk and Threat Considerations
Departing employees create a concentrated exposure period because they often know where valuable material sits and they may feel pressure, resentment, urgency or self-interest to take it before access ends. The risk is highest when offboarding is slow, privileges are broad, or monitoring is weak enough that bulk access looks ordinary.
Failure mechanism: the leaver retains legitimate access long enough to browse sensitive repositories, move data through normal channels, or stage copies in locations that are hard to inspect before termination.
Impact: intellectual property, customer data, credentials, internal plans or regulated records can be removed with less friction than a true external intrusion, and the organisation may not notice until after the employee is gone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Leaver risk depends on timely rotation and revocation of credentials, tokens and sessions. |
| AC-6 — Least Privilege | Departing employees need narrower rights to reduce bulk access and movement. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Offboarding benefits from monitoring unusual access and bulk extraction during the notice window. | |
| Recommendation — Revoke and rotate authenticator material as soon as offboarding begins. Reduce leaver permissions to the minimum required for handover. Review leaver activity for abnormal downloads, forwarding and lateral movement. | ||
| CIS Controls v8 | CIS-5 — Account Management | Leaver handling is fundamentally an account lifecycle and access removal problem. |
| Recommendation — Remove or disable accounts and access paths promptly when employment ends. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Zero trust principles fit changing trust relationships and continuous revalidation of access. |
| Recommendation — Apply continuous verification and least privilege to accounts in transition. | ||
Practitioner Guidance
Decision rule: once a departure is known, treat broad access as temporary and exceptional, not as something that remains in place until the final day by default. If a permission is not needed for handover, remove it early.
What to measure: time from notice to access reduction, number of remaining high-risk entitlements, and whether leavers still have routes that permit bulk download or cross-system movement. Those three signals tell you whether offboarding is actually shrinking exposure.
Common mistake: assuming that because the employee is still “authorised”, their activity is low risk. Authorised does not mean aligned, and leaver risk is precisely the period where that distinction matters most.
Practitioner takeaway: the objective is to preserve handover while making sure the departing employee can no longer assemble, copy or move material at scale before the trust relationship ends.
Related resources from NHI Mgmt Group
- Why do departing employees create a higher insider-risk window?
- Why do finance users create higher fraud risk than ordinary employees?
- Why do cloud CRM platforms create such high risk when privileged users or departing employees abuse access?
- Why does email exfiltration by departing employees create such a high data loss risk for organisations?