They fail because HR notice arrives after the behaviour that matters has often already started. People can prepare for departure for days or weeks while still looking like normal users. If the programme waits for the resignation event, it loses the window where detection can still stop exfiltration.
Why This Matters for Security Teams
Insider-risk programmes fail when they are wired to employment events instead of behaviour. HR notice dates are administrative milestones, but exfiltration, misuse of access, and privilege staging often begin earlier, while the user still appears ordinary in identity and endpoint logs. That gap matters because security controls usually trigger on visible status changes, not on intent, abnormal access sequencing, or unusual data movement.
Current guidance from the NIST Cybersecurity Framework 2.0 supports continuous risk management rather than one-time event response. NHIMG research on Why NHI Security Matters Now reinforces the same point for identities that act with delegated authority: once a trusted identity is in motion, delay creates exposure. In practice, many security teams encounter unusual download patterns, mailbox forwarding, or token harvesting only after a resignation has already made the risk visible to HR, rather than through intentional behavioural detection.
How It Works in Practice
A stronger programme treats HR notice as one signal, not the trigger. Security operations should correlate notice-date data with activity telemetry from identity providers, SaaS platforms, endpoints, and data stores. The goal is to detect behaviour that often precedes departure-related abuse: bulk file access, dormant system reactivation, privilege escalation attempts, off-hours authentication, and creation of forwarding rules or shadow accounts.
For human users, this usually means risk scoring that changes in near real time. For autonomous or semi-autonomous workflows, the same logic extends to whether an OWASP NHI Top 10 class of identity is being used beyond its normal task boundaries. That is why mature programmes move from static lists to conditional controls:
- raise risk scores when notice is received, but do not wait for it to begin monitoring;
- step up authentication and shorten session lifetimes for sensitive systems;
- restrict large exports, code repository cloning, and mailbox delegation;
- review access to secrets, tokens, and admin consoles before the final day;
- automate case creation when behavioural thresholds are crossed.
This aligns with the operational lessons in NHIMG’s Top 10 NHI Issues, where over-trusting long-lived access and delayed revocation repeatedly creates avoidable exposure. It also matches modern identity guidance from NIST, which treats access risk as dynamic rather than fixed by employment status alone. These controls tend to break down in large enterprises with fragmented SaaS estates and weak telemetry because behaviour can shift across systems faster than the programme can correlate it.
Common Variations and Edge Cases
Tighter monitoring around notice events often increases false positives and HR sensitivity, so organisations must balance privacy, labour relations, and security urgency. That tradeoff is real, and current guidance suggests the best programmes define clear triggers, approved use cases, and escalation paths before any resignation occurs.
There are also edge cases where notice dates are a poor proxy for risk. In involuntary separations, insider activity may accelerate before access is removed. In highly regulated environments, legal hold, works council requirements, or union constraints may limit how much pre-termination action is allowed. In distributed organisations, a person may exfiltrate data from personal devices or unmanaged cloud accounts outside the perimeter that the SOC expects.
NHIMG’s Ultimate Guide to NHIs is useful here because it frames the broader control failure: identity trust is only safe when it is continuously validated, not assumed because a record exists in HR. The practical answer is to tie notice events to pre-approved playbooks, then let behaviour determine the timing of containment. Where organisations rely on a single HR field as the trigger, they miss the fact that the most dangerous activity often happens before the resignation workflow is complete.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-1 | Continuous monitoring is needed because HR notice is too late as a trigger. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Long-lived access and delayed revocation are core insider-risk failure modes. |
| NIST AI RMF | Risk governance should focus on ongoing behaviour, not one administrative event. |
Use AI RMF governance to define continuous insider-risk decision points and escalation criteria.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
