Insider threat risk starts before resignation, not at notice

At a glance

What this is: This blog argues that insider risk begins in the intent phase, not when an employee formally resigns, and that behavioural signals can expose data-theft preparation earlier than HR-triggered monitoring.

Why it matters: IAM, IGA and insider-risk teams need to monitor behavioural context around identity activity, because waiting for resignation notice leaves a blind spot before exfiltration is already underway.

Context

Insider threat is not just a leaver-management problem. In this article, the security gap is temporal: legacy monitoring starts when HR records a departure, but risky behaviour often begins much earlier in the identity lifecycle.

The practical issue for identity governance is contextual blindness. A single action can look normal on its own, yet the sequence of job searching, data lookups and personal-email use can form an intent pattern that should shift the user into higher-risk review before notice is given.

Key questions

Q: What breaks when insider-risk monitoring only starts after resignation notice?

A: Security teams lose the period when employees are most likely to prepare for data removal. By the time HR records a departure, job searching, client lookups and personal-email transfers may already have created a breach path. The failure is temporal blindness, where governance reacts to employment status instead of intent indicators.

Q: Why do pre-departure insider behaviours increase exfiltration risk?

A: Because ordinary actions become meaningful when they occur in sequence. A resume upload, targeted data access and emailing files to personal accounts can show planned removal of sensitive material, even if each action looks acceptable on its own. Behavioural context turns low-signal activity into an actionable risk pattern.

Q: How can teams tell whether insider-risk analytics are working early enough?

A: They should look for investigations that begin before formal resignation, not after a leaver record appears. If the programme only detects problems on the last day, it is still operating as a reactive monitoring system. Effective analytics surface intent patterns while the user still has time to stage data movement.

Q: How should identity teams respond when trusted users have broad access to sensitive data?

A: They should pair lifecycle governance with behaviour-based monitoring for high-access roles, especially where client records, source code or strategy documents are involved. Broad legitimate access is not the problem by itself. The problem is allowing that access to remain unexamined until HR confirms the employee is leaving.

Technical breakdown

Why HR-triggered monitoring misses the intent phase

Legacy insider-risk programmes often depend on a clean business event, such as a resignation notice, to change monitoring posture. That works only if risky behaviour begins after the event. In reality, an employee can start collecting client lists, searching jobs and staging documents while still appearing to be a normal trusted user. The failure is not merely delayed response; it is a design that assumes intent becomes visible only when HR says so. Behavioral analytics changes the timing of detection by correlating actions across channels before the departure becomes official.

Practical implication: shift monitoring triggers away from HR status alone and into behavioural patterns that signal pre-departure intent.

How identity correlation turns noisy actions into a risk signal

Identity correlation is the process of tying web activity, database access and messaging events to the same person so isolated events become a timeline. A resume upload, a people-search query and a personal-email transfer may each look benign in isolation. Linked together, they show preparation for data removal. The technical value is not the model count or alert volume. It is the ability to interpret sequences across logs that traditional SIEM rule sets treat as unrelated or low priority.

Practical implication: unify identity, endpoint and communication logs so behavioural sequences can be scored as one risk story instead of separate low-signal events.

Why flight-risk scoring matters more than single-event alerts

Single-event alerts are weak for insider threat because preparation rarely looks like a breach at the moment it occurs. Risk scoring provides context by weighing behaviour against peer norms and prior activity, then escalating when the pattern diverges. That is especially important for employees with legitimate access to sensitive data, where the exfiltration path uses approved tools and ordinary permissions. The control problem is not just detection, but discrimination between routine work and early-stage asset preparation.

Practical implication: use behaviour-based scoring to prioritize investigations before exfiltration, not after a single suspicious event crosses a fixed threshold.

Threat narrative

Attacker objective: The objective is to remove valuable client, source-code or strategic data before the employee formally exits and governance controls tighten.

1. Entry occurs through legitimate user access that is already trusted by the organisation, so the activity blend starts inside normal identity permissions rather than at the perimeter.
2. Escalation happens when the user combines job-search behaviour, client lookups and self-emailing, turning ordinary actions into a coordinated preparation pattern.
3. Impact follows when sensitive records are copied to personal channels or cloud storage before departure, creating data loss while the user still appears to be in role.

Breaches seen in the wild

• Coinbase insider bribery breach 2025: Criminals bribed overseas Coinbase support agents to copy data on 69,461 customers, then tried to extort $20 million.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Notice-based insider-risk governance is structurally late. The article exposes a governance model that waits for HR state change before security posture changes. That assumption is wrong because preparation can begin while the employee is still fully active and trusted. The implication is that insider-risk programmes must treat behaviour as the governance signal, not resignation status.

Identity correlation is the real control plane for insider threat. A single web search or self-email event is not meaningful on its own. What matters is whether identity-linked telemetry across web, data and messaging layers tells a coherent story of departure intent. Practitioners should view correlated behaviour as the unit of analysis, not isolated alerts.

Behavioral blindness creates an identity blast radius. When a user with legitimate access can stage exfiltration inside normal permissions, the organisation has allowed ordinary access to become a loss path. The named concept here is the identity blast radius: how far a trusted identity can move sensitive data before detection changes. Practitioners need to measure that exposure window, not just alert volume.

Insider threat governance now sits at the intersection of IAM and IGA. Access reviews alone do not solve pre-departure risk if the user still appears entitled until the final day. The article shows why lifecycle governance must be informed by behavioural evidence, especially for high-access roles. Security teams should align insider-risk review with identity lifecycle events and observed intent patterns.

Reactive SIEM logic underestimates the speed of departure-driven exfiltration. The article’s core lesson is that rules tuned to known bad events miss the slow build-up that precedes loss. That gap is not a tooling defect alone; it is a timing mismatch between how people leave and how control programmes watch. Practitioners should redesign for pre-notice escalation.

What this signals

Identity blast radius: the useful question is not whether a trusted user can access sensitive data, but how far that identity can move it before the programme notices. When access reviews depend on HR state alone, the review clock starts too late and the loss window is already open.

Behaviour-based insider-risk programmes should be treated as a timing control, not just a detection control. The practical difference is whether security can elevate review before departure becomes official, or only reconstruct the event after data has already been staged for removal.

For practitioners

• Map pre-notice behavioural signals to higher-risk review Create escalation criteria for job-site visits, resume uploads, people-search activity and self-emailing when they occur in sequence, not as isolated events.
• Correlate identity activity across core logs Join webproxy, database and messaging telemetry to the same identity so preparatory actions form a single investigative timeline.
• Tune insider-risk scoring around departure intent Weight behaviour that indicates offboarding intent more heavily for users with access to client lists, source code or strategic plans.
• Review leaver workflows for behavioural triggers Add behavioural checkpoints before formal resignation handling so security can intervene before the final notice date.

Key takeaways

• The article’s central point is that insider risk often begins before formal resignation, when intent can still be hidden inside ordinary work activity.
• The evidence model is behavioural, not event-based. Job-search activity, client lookups and personal-email transfers gain meaning when they appear in sequence.
• The control gap is waiting for HR notice. Security teams need pre-notice behavioural escalation if they want to reduce data loss from departing employees.

Key terms

• Behavioral Intelligence: Behavioral intelligence is the use of session patterns to judge whether an action looks normal for a specific user. In banking, it compares cadence, navigation, pauses, and correction patterns against prior sessions to detect coercion, guidance, or automation that authentication alone cannot reveal.
• Flight Risk: Flight risk is the condition where a user shows signs of leaving an organisation while still holding access to sensitive systems or data. In security terms, it is a warning state that often precedes theft, disclosure, or policy violation if access is not re-evaluated quickly.
• Identity correlation: Identity correlation is the process of linking multiple account records to one governed subject. It lets IAM and IGA teams understand that separate usernames, principals, or emails may belong to the same employee or workload, which is essential for access review, offboarding, and entitlement analysis.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.