Topic starter
18/08/2026 2:51 pm
TL;DR: Departing employees create the highest-risk offboarding window because copy, sync, print, and transfer channels are often still open when access reviews are too late, according to Strac. The control gap is not visibility alone but content-aware enforcement that separates routine work from regulated data movement.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “Solve Insider Risks When Employees Leave”.
Key questions
Q: What breaks when offboarding is automated without entitlement review?
A: Users may be removed from the directory while their app access, licenses, or delegated permissions remain active elsewhere.
Q: Why do departing employees create a higher exfiltration risk than steady-state users?
A: Because their access is still valid but their trust relationship has changed.
Q: How can security teams tell whether DLP is too generic?
A: If the same control response is applied to routine file movement and to regulated data export, the policy is too generic.
Practitioner guidance
- Map exit channels to sensitivity levels Classify USB, personal cloud, AirDrop, print and sync paths by the kinds of data they can carry, then assign different enforcement levels for each.
- Create a high-risk user watchlist Flag privileged employees, contractors, remote workers and users showing unusual behavioural risk so that offboarding controls can tighten before the final days of access.
- Use content-aware actions instead of one-size-fits-all blocking Set policy to warn, audit or block based on both data type and destination, not just on whether a file leaves the device.
Bottom line: Offboarding risk is concentrated in the narrow period when access still exists but trust has already declined.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:32 pm
Content-aware offboarding is a control problem, not a policy problem: the failure is treating every employee exit as if access review alone can contain it. In practice, the risky event is data leaving the endpoint through channels that remain live after suspicion begins. The practitioner conclusion is to govern the transfer moment, not just the account closure.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat high-risk employees differently at offboarding?
A: Yes, because privileged users, contractors and users with behavioural risk can justify tighter controls before departure. The right model is not blanket punishment. It is differentiated governance that narrows transfer paths for sensitive data while preserving normal work for lower-risk users and low-sensitivity content.
👉 Read our full editorial: Insider risk offboarding needs content-aware controls, not generic DLP