Data exfiltration by departing employees exposes the insider risk gap

At a glance

What this is: This whitepaper frames employee departures as a data exfiltration risk, arguing that visibility alone is not enough without context and response capability.

Why it matters: It matters because IAM, insider risk, and data security teams need controls that detect and interpret leaving-user behaviour before sensitive data is removed.

Context

Employees who are preparing to leave a company often have both motive and opportunity to collect files, records, or source material they think they may need later. In practice, the governance gap is not simply whether data is visible, but whether the security team can connect access, behaviour, and business context quickly enough to act before exfiltration occurs.

This sits at the intersection of insider risk, data security, and identity governance because the same user who appears legitimate can still become a loss path at offboarding time. The article's core message is that static discovery and labels do not solve the problem on their own; teams need operational context that can keep pace with the leaver lifecycle.

Key questions

Q: What fails when departing employees can still access sensitive data?

A: The failure is assuming legitimate access remains safe until offboarding is complete. Departing employees may use their normal permissions to collect files or records before leaving, so the control gap is not authentication alone but the lack of behavioural context around exit intent, sensitive data movement, and intervention timing.

Q: Why does leaver data exfiltration need insider risk governance, not just DLP?

A: DLP can block or flag transfers, but it often lacks the identity and lifecycle context needed to tell whether a transfer is part of normal work or departure-driven exfiltration. Insider risk governance adds user state, intent signals, and escalation paths so teams can act before the data leaves approved systems.

Q: What are the signs that an employee may be misusing data before they leave an organization?

A: Warning signs include unusual exports, large downloads, access patterns that do not match the person’s role, and activity in business applications that looks abnormal compared with normal behavior. Monitoring should focus on who accessed the data, what changed, where it was used, and when. Those signals let security teams investigate quickly and stop theft before sensitive information leaves the organization.

Q: Should organisations prioritise data lineage or data classification for insider risk?

A: They are complementary, but lineage is the better prioritisation when the question is exfiltration. Classification tells you what the data is, while lineage shows how it moves and who interacts with it, which is what turns a leaving-user event into a prioritised investigation.

Technical breakdown

Why leaver activity creates a data exfiltration window

Departing employees often know which files, repositories, customer records, or project materials are likely to be useful after they leave. That creates a short but meaningful exfiltration window where legitimate access is still active, yet intent may already have shifted. Conventional monitoring tends to see access events in isolation, which makes the behaviour look normal until the volume, destination, or timing becomes suspicious. The hard part is not identifying data at rest, but recognizing when a legitimate user is acting like a risk actor inside their normal access boundary.

Practical implication: insider risk programmes need behavioural context tied to departure signals, not just static data alerts.

Why data discovery and data classification are not enough

Data discovery tells you where sensitive information exists, while classification tells you how it is labelled. Neither necessarily tells you whether a departing employee is about to move that data somewhere unsafe, or whether the access path is unusual for the user's role. The article points to data lineage as the missing context layer because lineage can show how data moves across systems, who touched it, and which business processes it supports. Without that, teams can know they have sensitive data without knowing which movement actually matters.

Practical implication: pair discovery and classification with lineage so analysts can prioritise the transfers that matter most.

How AI-native insider risk changes the response model

AI-native insider risk management is being framed here as a way to reduce analyst delay between signal and action. In this model, the system is not just spotting a file copy or download, but correlating user behaviour, data sensitivity, and departure context quickly enough to make the event actionable. That matters because exfiltration rarely waits for a manual review queue. The operational question is whether the platform can elevate the right cases early enough to trigger intervention before the data leaves the environment.

Practical implication: build detection workflows that score departure-adjacent behaviour for immediate analyst triage.

Threat narrative

Attacker objective: Collect sensitive company data before departure and remove it from approved environments while access is still available.

1. Entry occurs through continued legitimate access while an employee is still active but preparing to depart, allowing normal credentials to be used without immediate suspicion.
2. Credentialed access is then used to locate and collect sensitive files, records, or project data that may be useful after exit.
3. Exfiltration follows when the employee moves the collected data out of approved systems before offboarding completes.
4. The objective is to preserve access to valuable information after separation, either for personal use or future leverage.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Leaver-driven exfiltration is a lifecycle problem, not a visibility problem. Security teams often assume that if data is discoverable, it is governable, but departing employees can move from routine access to risky behaviour inside the same account and workflow. The control gap is the absence of timely context around exit intent, access patterns, and sensitive data movement. Practitioners should treat offboarding as a high-risk identity lifecycle state, not an HR afterthought.

Data lineage is the missing bridge between discovery and action. Discovery and classification answer where sensitive information lives, but they do not explain which movements are normal, which are sensitive, and which are precursors to loss. Lineage matters because it reveals the path data takes through systems and users, which is what insider risk analysts need when the user is still authenticated. Practitioners should align monitoring to data flow, not just data labels.

AI-native insider risk is becoming the practical response to analyst overload. The article's premise is that catching leaver exfiltration early requires more than alert volume. AI-driven correlation can help separate routine access from departure-adjacent behaviour, especially when the signal set spans identity, content, and timing. Practitioners should evaluate whether their current tooling can compress time-to-context before exfiltration completes.

Leaver exfiltration exposes a standing-access assumption that identity governance still underestimates. Traditional access models assume authorised users remain low risk until access is formally removed, yet departing employees may already be acting against the organisation's interest. That means offboarding controls, insider risk controls, and data security controls need to work as one governance chain. Practitioners should redesign leaver handling around behavioural risk, not just account removal.

What this signals

Departure-aware monitoring is becoming a governance requirement, not an optional analytics layer. The useful question is no longer whether a team can see sensitive content, but whether it can connect that content to leaving-user behaviour quickly enough to interrupt a loss path. That pushes insider risk closer to IAM and offboarding governance than many programmes currently manage.

Data lineage gives insider risk teams the context that raw discovery cannot. When a leaver touches sensitive material, the priority is to understand whether the movement is operationally normal or a precursor to removal from the environment. Practitioners should use lineage to narrow investigations before the user’s access disappears.

For practitioners

• Tighten leaver monitoring before offboarding completes Flag employees in notice periods or role-transition windows for enhanced review of downloads, syncs, sharing events, and unusual repository access.
• Correlate data movement with departure signals Join HR exit indicators, identity telemetry, and file activity so analysts can prioritise access patterns that coincide with separation risk.
• Use lineage to triage sensitive transfers Map how sensitive data moves across systems so investigators can distinguish routine collaboration from data paths that support exfiltration.
• Review offboarding controls for delayed data loss Check whether access removal, device handback, and data preservation steps are sequenced to prevent last-day copying or cloud sync abuse.

Key takeaways

• Departing employees create a narrow but meaningful exfiltration window because their access remains legitimate even when their intent may no longer be aligned with the organisation.
• The article's core governance gap is not lack of data visibility, but lack of context that turns discovery into an actionable insider risk decision.
• Teams that want earlier intervention need offboarding, identity telemetry, and data lineage to work together as one control path.

Key terms

• Insider Risk Management: Insider Risk Management is the practice of detecting, investigating, and reducing harm caused by legitimate identities misusing access. It covers human error, malicious insiders, compromised accounts, and increasingly AI-driven actors that can move sensitive data without breaking perimeter controls.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Off-boarding: Off-boarding is the process of removing a departing user’s access, credentials, and related entitlements from the environment. In mature IAM programmes, it also includes reviewing sessions, shared secrets, delegated roles, and linked non-human identities so that exit events do not leave behind hidden access paths.
• Data classification: Data classification is the process of labelling information according to sensitivity, regulatory impact, or business value so controls can be applied consistently. For AI governance, it allows policy to follow the data into prompts, sessions, and destinations rather than relying on brittle text matching.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management in the context of real-world access risk. It is suitable for practitioners aligning identity controls with broader security operations.