- › The notice period is the highest-risk window in the employment lifecycle and almost nobody treats it as one.
- › Most departure data movement is not theft in the mind of the person doing it, which is why warnings do not stop it.
- › The three categories that leave are work samples, contact lists, and reference material, and each has a different answer.
- › Monitoring that starts at resignation tells you nothing, because you have no baseline for that person to compare it against.
- › Say what belongs to whom in the resignation conversation, because nobody has ever told them and they will mostly comply.
A departing employee sat across from me during an assessment interview and described, without any hesitation or awareness that it mattered, emailing herself the entire folder of proposals she had written over four years. She was not hiding it. She said it the way you would mention packing up a desk, because in her mind that is precisely what it was.
She had written those documents herself and stayed late on several of them. Nobody had ever told her they were not hers, and the only place she had ever seen a rule about it was a policy she acknowledged on her first day, four years earlier, alongside eleven other documents.
That interview is the whole subject of this article. The notice period is the most exposed window in the entire employment lifecycle, and the reason it stays open is that we have categorized it as a security problem when most of what happens inside it is not a security decision at all.
The Window Nobody Watches
Look at how attention is distributed across an employment relationship. Onboarding gets a process, a checklist, and a set of provisioning tickets, and we have written about what the first week actually teaches people. The last day gets a process too: badge back, laptop back, accounts disabled, a form somebody signs.
Between those two sits the notice period, which is typically two weeks and sometimes two months. During it the person retains full access to everything they had the week before, has a concrete reason to gather material, has stopped being invested in the outcomes of the place, and knows exactly when the door closes. Every one of those conditions is unusual and all four hold simultaneously.
Access review does not run in that window. Monitoring, if it exists, is calibrated for a workforce rather than for an individual under a deadline. The manager is focused on the handover and on backfilling the role, which is a reasonable priority. Nobody owns the window.
Most of It Is Not Theft, and That Matters
Here is the part that changes what you should do about it. When people take material on the way out, the large majority are not making a decision they would describe as wrong, and the ones who are stealing already know how to avoid whatever you have deployed.
The psychology is ordinary. People build a sense of ownership over work they personally produced, and the intensity of that feeling tracks the effort they put in rather than the employment contract that governs it. A proposal you wrote at eleven at night feels like yours. The distinction between the intellectual capability you developed, which genuinely is yours and travels with you, and the artifacts you produced using company time and company data, which are not, is a legal boundary that has never been explained in terms anybody found memorable.
Add the timing. Somebody in a notice period is in a transitional state, holding a professional identity that no longer fits and one that has not started yet, and gathering evidence of competence is a completely natural response to that. It also happens to look identical to exfiltration in a log.
This is why deterrence messaging underperforms in this window. A warning about consequences is addressed to somebody who has decided to do something wrong, and it lands on somebody who does not believe they are doing anything wrong at all.
Three Things Leave, and They Are Not the Same Problem
Treating departure data movement as one category is what makes the response ineffective. In practice three different things walk, for three different reasons.
Work samples. Proposals, designs, code, reports, decks. The motivation is portfolio and proof of ability. This is the largest category by volume and usually the lowest actual harm, and it is also the one that responds best to being addressed directly, because the person will negotiate if you give them something to negotiate with.
Contact lists. Customers, candidates, suppliers, partners. Higher harm, more likely to be contractually covered, and the category most likely to be genuinely deliberate. Somebody exporting a customer list generally understands they are doing something the company would object to.
Reference material. Templates, process documents, pricing sheets, research. This one is almost invisible because nobody thinks of it as sensitive, and it is frequently where your actual competitive method lives. The person taking it is trying to avoid rebuilding something from scratch at the new job.
Each needs a different answer, and running one response across all three is why the effort usually fails. The first is mostly a conversation you can have in ten minutes. The second is a control and sometimes a lawyer. The third is a classification problem you have been deferring for years.
Monitoring That Starts at Resignation Tells You Nothing
The instinct is to turn up logging on somebody the moment they resign. It rarely produces anything useful, and the reason is methodological.
Behavior is only interpretable against a baseline. If you begin observing a person on the day they give notice, you have no idea what their normal week looks like, so you cannot distinguish a large download that is exactly what they do every Thursday from one that means something. What you get instead is a volume of activity that looks alarming to somebody who has never looked before, and the resulting conversation is uncomfortable for everyone and evidentially worthless.
There is also a fairness problem worth taking seriously, which is the same one I have argued about indicators generally: retrospective suspicion applied to a person who has done nothing except resign is corrosive, and people notice being treated as a suspect for giving notice. It reaches the people still employed within about a day.
If you want departure monitoring to mean anything, the baseline has to exist before the resignation. That is an argument for continuous behavioral visibility applied evenly across everyone, which is a bigger program decision than a departure checklist, and it is the honest answer.
What Actually Works
Five things, ordered by how much they return for the effort involved. The first one is free and outperforms everything below it.
Say what belongs to whom, in the resignation conversation
Not in the exit interview on the last day, which is far too late, and not in the handbook. In the first conversation after somebody gives notice, say plainly: your skills and your experience are yours and you should absolutely use them, the documents and data you produced here belong to the company, and here is what that means for the portfolio you are probably thinking about. Most people comply when told, because most of them were never told. This single conversation does more than any technical control on this list.
Offer a sanctioned way to keep a portfolio
For the work-samples category, agree what they may take and redact it together. A designer keeping three anonymized case studies is a solved problem and an unmanaged wholesale export is not. Giving somebody a legitimate route removes the reason for the illegitimate one, and it takes about an hour of a manager’s time.
Review access on the day of resignation
Not to remove it, since they still have a job to do, but to see it. Most people accumulate access across years and roles that nobody has revisited, and the person leaving your finance team may still hold something from the operations role they held in 2023. Look at the list and remove what the remaining two weeks genuinely do not require.
Make the manager the control
The person who knows whether behavior is unusual is the direct manager, who has seen this individual work every day for years. Ask them a specific question, which is whether anything about how their report is working right now looks different from how they normally work. That question outperforms a dashboard because it is asked of somebody with a real baseline.
Fix classification for the third category
Templates, pricing, and process documentation walk because nobody has ever labeled them as anything. This is genuinely tedious work and it is also the only durable fix for the invisible category, since you cannot ask people to protect material you have never identified as worth protecting.
The Uncomfortable Part
None of this eliminates the deliberate case. Somebody who has decided to take a customer list to a competitor will take it, and the controls that stop them are contractual and legal rather than behavioral.
What this does is remove the large majority of the volume, which is people acting on an ownership feeling nobody ever corrected, and it does that without treating every resignation as a suspicion. That distinction is worth protecting, because a program that treats leaving as evidence of bad intent will be understood exactly that way by the people who are staying.
If you want a read on how your organization handles the notice period, contact Grab The Axe, and the first thing we will ask is what gets said in the conversation right after somebody resigns. You can also take our free Human Attack Surface Score, and our insider threat program guide covers the structural side of this.
Marie Welch is Director of Behavioral Security Operations at Grab The Axe.
With a dual background in I/O Psychology (PhD Candidate) and Business Management (MBA), Marie bridges the gap between clinical rigor and operational strategy. She oversees B2B relations, compliance, and the 'business' of risk management.
View Author Page →
