Data exfiltration by departing employees exposes the insider risk gap

At a glance

What this is: This whitepaper argues that departing employees create a high-risk exfiltration window because they can collect data they expect to reuse personally or elsewhere.

Why it matters: It matters to IAM and security teams because insider risk, access governance, and data controls must work together when a user’s access, intent, and employment status are changing at the same time.

By the numbers:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read Cyberhaven's whitepaper on stopping data exfiltration by departing employees

Context

Insider risk becomes hardest to manage when employment status changes faster than security controls can respond. In this case, the core problem is not whether data exists, but whether organisations can detect when a departing employee starts collecting material outside normal work patterns.

That matters for identity and access governance because leavers often still hold legitimate access while their incentives shift. The article also points to a broader data governance gap: classification alone does not tell you whether a user is moving data in ways that are consistent with their role, which is why lineage and behavioural context become important.

Key questions

Q: What breaks when non-employee access is not removed at offboarding?

A: When non-employee access is not removed at offboarding, the organisation loses control of who can still reach admin, customer, or communications systems. That stale access can be used for fraud, data theft, account abuse, or reputational damage. The failure is not just technical. It is a lifecycle governance gap that leaves business-critical permissions active after the relationship ends.

Q: Why do data classification labels often miss insider exfiltration risk?

A: Classification tells you that data is sensitive, but it does not show whether the movement is expected, excessive, or tied to a departure event. Insider exfiltration often looks like ordinary user activity until you add behavioural context and lineage. Labels are necessary, but they are not sufficient for decision-making.

Q: How can security teams tell whether a leaver is staging data for exit?

A: Look for repeated downloads, unusual compression or export activity, transfers to personal locations, and access patterns that change after resignation is known. The strongest signal is correlation. A single file copy may be normal, but several changes in a short period often indicate staging behaviour that needs review.

Q: Who is accountable when insider exfiltration occurs during offboarding?

A: Accountability is shared across security, HR, and the business owner for the affected data, but security teams need clear ownership for monitoring and response. Frameworks such as NIST CSF and NIST SP 800-53 support this by tying monitoring, access control, and auditability to operational responsibility.

Technical breakdown

Why departing employees create a data exfiltration window

A resignation period creates a distinct risk window because the user still has valid access, yet the likelihood of copying material for personal retention, future employment, or informal sharing rises. Traditional controls often focus on access entitlement, but exfiltration happens through legitimate channels such as file downloads, email, cloud drives, USB media, or browser uploads. The challenge is not simply blocking access. It is understanding when data movement becomes inconsistent with normal role behaviour and employment context.

Practical implication: monitor leaver activity continuously and tie alerts to employment status changes, not just access entitlements.

Data discovery, classification, and lineage are different controls

Data discovery identifies where sensitive data resides. Classification assigns labels such as confidential or restricted. Lineage adds the missing context by showing how data moves, transforms, and is used across systems. Without lineage, security teams may know a file is sensitive, but not whether it has been copied, reshared, or blended into an export path. That is why static labels often go stale in fast-moving environments and why discovery tooling alone rarely gives enough evidence to act confidently.

Practical implication: use lineage to confirm whether sensitive data movement is expected, anomalous, or high-risk before escalating.

AI-native insider risk management changes the detection model

AI-native insider risk management uses behavioural analysis and pattern recognition to surface weak signals that manual review misses. In this context, AI is not replacing governance. It is helping security teams correlate user intent, data sensitivity, and timing across many events. That matters because leaver-related exfiltration often looks normal in isolation. The risk becomes visible only when the system can connect repeated access, unusual retrieval volume, and departure context into one narrative.

Practical implication: calibrate detections around correlated behaviour patterns, not isolated downloads or single file movements.

Threat narrative

Attacker objective: The objective is to preserve valuable company data for personal use, future advantage, or unauthorised sharing after departure.

1. Entry begins when a departing employee retains valid access to internal systems during notice or offboarding periods.
2. Escalation occurs as the user collects files, exports data, or moves sensitive records into personal storage or email channels using legitimate credentials.
3. Impact follows when confidential information leaves organisational control and is no longer recoverable through normal access revocation alone.

NHI Mgmt Group analysis

Departing-worker exfiltration is a lifecycle problem, not just an insider-threat problem. The decisive failure is often that access governance ends too late, after the employee has already had time to stage data for departure. That makes leaver management an identity lifecycle control issue as much as a detection issue. Practitioners should treat exit periods as a distinct governance state with tighter monitoring and shorter response windows.

Data lineage closes the gap that classification leaves open. Classification tells you what data is sensitive, but not how it is moving or whether that movement is consistent with the user’s role. Lineage introduces traceability across systems, which matters when exfiltration happens through ordinary tools and approved accounts. The security lesson is that context, not labels alone, determines whether a transfer is harmless or harmful.

AI-native detection is increasingly necessary because the signal is behavioural, not purely rule-based. Departing employees do not always trigger obvious policy violations. They often create small anomalies that only become meaningful when correlated over time. This is where the named concept leaver exfiltration window matters: the period between resignation intent and full access removal is long enough to copy data, but short enough that manual review usually misses it. Organisations should narrow that window.

Insider-risk tooling must be evaluated against evidence quality, not just alert volume. Many programmes surface activity but fail to provide enough context for legal, HR, or security action. That creates friction at the exact point where teams need confidence to intervene. The practical question is whether the programme can prove what moved, when it moved, and whether it was consistent with normal access, because that is what determines response quality.

What this signals

Departing-worker risk should be treated as a governance signal that access and intent can diverge before revocation happens. For identity teams, that means lifecycle controls, joiner-mover-leaver workflows, and data-access telemetry need to operate as one programme rather than separate functions.

Leaver exfiltration window: the interval between resignation intent and access removal is where most insider-risk controls are tested, because normal activity and suspicious staging can look similar. Practitioners should focus on reducing that interval and enriching alerts with employment context rather than relying on static thresholds.

For programmes that already use data discovery, the next maturity step is lineage-linked evidence. That gives investigators a defensible view of what moved, where it went, and whether the movement fits business need. Without that, the security team can detect activity but cannot always support action.

For practitioners

• Tighten leaver monitoring before offboarding completes Create a dedicated monitoring tier for employees in notice periods, with increased review of downloads, transfers, shared-drive activity, and personal-email forwarding from the moment departure is known.
• Correlate activity with employment status changes Feed HR departure signals into insider-risk workflows so anomalous retrieval volume, off-hours access, or repeated exports are evaluated in the context of resignation or termination status.
• Use lineage to validate sensitive-data movement Track where sensitive records originate, how they are transformed, and where they are copied so investigators can distinguish ordinary work from suspicious staging for departure.
• Shorten access removal latency for departing staff Automate access revocation for high-risk accounts as soon as exit workflow milestones are reached, especially for cloud drives, collaboration tools, and email forwarding rules.
• Separate discovery from decision-making in insider risk Use data discovery to find sensitive content, then require lineage and behavioural context before escalation so teams do not rely on labels alone to justify action.

Key takeaways

• Departing employees create a specific exfiltration window because legitimate access can remain active after intent changes.
• Data classification alone cannot prove suspicious movement, which is why lineage and behavioural context matter for insider-risk decisions.
• Security teams should reduce offboarding latency and correlate leaver status with data-access telemetry before sensitive material leaves control.

Key terms

• Insider Risk Signal: An insider risk signal is a recurring behaviour pattern that may indicate misuse, negligence, or process breakdown involving sensitive information. It is not proof of malicious intent on its own, but it does show where identity, behaviour, and data handling controls may be misaligned.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Leaver Exfiltration Window: The leaver exfiltration window is the period between resignation intent or departure notice and the full removal of access. During that time, a user may still act like a normal employee while preparing to remove sensitive information from organisational control.
• Insider Risk Management: Insider Risk Management is the practice of detecting, investigating, and reducing harm caused by legitimate identities misusing access. It covers human error, malicious insiders, compromised accounts, and increasingly AI-driven actors that can move sensitive data without breaking perimeter controls.

What's in the full article

Cyberhaven's full whitepaper covers the operational detail this post intentionally leaves for the source:

• How Cyberhaven says Linea AI surfaces exfiltration behaviour during resignation periods
• The insider-risk workflow details behind early detection and escalation decisions
• Examples of how departing employees move sensitive data through common business tools

👉 Cyberhaven's full whitepaper covers the detection approach, leaver-risk examples, and AI-native workflow detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management in practical terms. It helps practitioners connect access control, offboarding, and governance across human and non-human identity programmes.