They should do both as soon as departure signals appear, because retention and security are linked. Managers should discuss burnout, workload, pay, growth, and work life balance while security teams monitor for unusual access patterns. That approach helps reduce turnover, surface dissatisfaction early, and prevent a departing employee from turning access into a data loss event.
When to pair retention conversations with offboarding monitoring
Use both as soon as departure signals appear, not after a resignation letter or access request lands. The practical reason is that retention and security are part of the same risk window: the same dissatisfaction that raises turnover risk can also increase the chance of data removal, account misuse, or rushed handover before access is revoked.
That means managers and HR should treat burnout, workload, pay, growth, and work life balance as live indicators while security monitors for unusual access patterns, bulk downloads, unusual login times, or new data movement from a person who may leave.
What the combined approach is trying to prevent
The goal is not to assume bad intent. It is to reduce the odds that a disengaged employee leaves with unresolved access, unreturned secrets, or a final burst of copying that turns a routine exit into an insider-risk event. In offboarding, timing matters because the shortest path to loss is often a delay between the first warning sign and the first control action.
Retention efforts can lower the chance that the employee becomes a leaver at all, while monitoring can shorten the time between warning signal and containment. Used together, they improve visibility into whether the issue is a correctable workplace problem or a security escalation that needs tighter supervision.
For organisations that manage employee access well, this is the point where Joiner-Mover-Leaver (JML) Guide logic meets real-world offboarding behaviour: once the departure risk becomes visible, leaver controls, entitlement review, and access removal should begin to tighten in parallel with the retention conversation.
How to run retention and security in parallel without overreacting
Start with the smallest useful set of coordinated actions. Managers should handle the human conversation, while security and identity teams should watch for change in behaviour, privilege use, and access scope. If the employee is critical, highly privileged, or close to sensitive data, the monitoring threshold should be lower and the deprovisioning plan should be prepped earlier.
If the employee is merely unhappy but not yet a leaver, use the signal to improve management attention and review whether access still matches current duties. If the employee has formally resigned or is actively disengaging, move to tighter session monitoring, access review, and offboarding coordination immediately.
In practice, this is where a lifecycle view helps. A mature offboarding process does not wait to find out whether a secret was abused after departure. It assumes the risk rises before the final date and that access, tokens, and shared credentials must be handled as part of the departure process itself.
That is why a broader lifecycle reference such as NHI Lifecycle Management Guide is useful here: even though the subject is employee offboarding, the underlying control pattern is the same, remove or constrain access before the departure window becomes a loss event.
Risk and Threat Considerations
The main risk is delayed recognition. If retention and monitoring live in separate silos, organisations may either miss early dissatisfaction or fail to connect it to unusual access behaviour. That gap gives a departing employee time to copy data, reuse dormant access, or exploit weak offboarding hygiene before controls catch up.
Failure mechanism: Departure signals emerge first in the business relationship, while access and data controls remain unchanged. In that gap, a user with legitimate access can still browse, export, or stage information before deprovisioning or review happens.
Impact: The result can be unnecessary attrition, avoidable insider loss, and a larger blast radius if the employee leaves with unresolved permissions, active sessions, or unrecovered credentials. In sensitive environments, the same gap can become a confidentiality incident rather than a routine HR event.
Where organisations already know that offboarding failures can expose signing keys or other sensitive material, the lesson is not theoretical. Coupang Signing Key Breach is a reminder that unresolved post-employment access can create very large downstream exposure when secrets are left reachable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Leaver risk makes credential lifecycle control central to preventing post-departure misuse. |
| AC-2 — Account Management | Offboarding depends on timely account disablement and access removal. | |
| AU-6 — Audit Review, Analysis, and Reporting | Unusual access during departure windows requires review of logs and anomalies. | |
| Recommendation — Revoke or rotate authenticators and secrets as soon as departure risk is confirmed. Disable or reassign accounts promptly when an employee begins the offboarding path. Review authentication and access logs for unusual activity during the departure window. | ||
| CIS Controls v8 | CIS-5 — Account Management | Retention-linked offboarding depends on promptly removing access for departing staff. |
| Recommendation — Remove departing employees' access and review shared accounts before exit day. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The topic centers on offboarding as a security failure point for identities and secrets. |
| NHI-07 — Long-Lived Secrets | Departing staff often leave behind secrets that outlive the employment relationship. | |
| Recommendation — Offboard identities, tokens, and secrets before the departure window closes. Rotate or revoke long-lived secrets tied to departing employees. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Departing employees may abuse still-valid access to copy data or persist. |
| T1021 — Remote Services | Active sessions and remote access can be abused before deprovisioning completes. | |
| Recommendation — Hunt for misuse of valid accounts during the offboarding period. Monitor remote access sessions for abnormal use during exit processing. | ||
Practitioner Guidance
What to prioritise: Tie the first retention check to the first offboarding control review. If the employee is in a sensitive role, do not wait for formal notice before checking whether access scope, shared credentials, or privileged sessions need review.
What to verify: Confirm that managers, HR, and security are looking at the same departure signal. If the business sees burnout or dissatisfaction but security sees unusual downloads or access spikes, treat that as a coordinated risk event, not two unrelated issues.
Common mistake: Treating retention as purely cultural and offboarding as purely technical. That split is where organisations lose time, and time is the control that usually fails first.
Practitioner takeaway: The right question is not whether to choose retention or monitoring, it is whether the organisation can detect departure risk early enough to reduce both turnover and the chance of a data loss event.
Related resources from NHI Mgmt Group
- What happens when organisations do not combine user access controls with monitoring and offboarding for insider threat risk?
- Why does excessive employee monitoring create security and compliance risk for organisations?
- When should organisations treat an NHI as a high-priority risk?
- How can organisations reduce the risk of shadow SaaS and shadow AI during offboarding?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
