Preventing Data Leaks Before an Employee Leaves: Signals, Records and the Two-Week Window
Most insider data theft happens in the two weeks before someone resigns, and it happens with tools the company already gave them. Here is what to look for and what to record, in the order it becomes useful.
Why departing employees are the highest-risk group
They have legitimate access, a reason to take things, and a short window before that access disappears. Theft is rarely dramatic: the customer list is exported as CSV, the pricing spreadsheet is mailed to a personal address, the design files go onto a USB stick in a handbag. None of it looks like hacking, which is why network security tools rarely catch it.
The signals worth recording
- Bulk export. A CRM export that previously happened quarterly suddenly happening twice in a week, or one user downloading the full customer table instead of their own accounts.
- Removable media. First use of a USB drive in months, or a large volume copied to one.
- Personal-channel transfer. Work files attached to webmail, or uploaded to a personal cloud drive.
- Print spikes. Printing twenty customer contracts in an afternoon is a classic exit move.
- Off-hours access. Files touched at 23:00 by an account that normally works 9-to-6.
- Permission probing. Attempts to open folders outside the person's scope.
What you can and cannot do about it
You can monitor company equipment, and in most US states you can do so without prior notice — but notice and a written policy are what make the resulting evidence useful, and several states require notice outright. You cannot read personal accounts, install monitoring on personal devices without consent, or keep records longer than you can justify.
Practical boundary: record actions (a file copied, a device connected, a print job sent) rather than content (what a message said). Actions answer the question "did this leave the building". Content usually does not, and costs far more in trust.
The two-week window that matters most
- When HR opens a resignation, have IT flag the machine for enhanced logging — not restrictions, which tip people off and invite workarounds.
- Review exports, USB activity and outbound attachments during the notice period.
- Require a handover with a written inventory: accounts, files, devices, credentials.
- On the last day: disable accounts, collect devices, revoke tokens, rotate shared passwords.
WorkAuditor covers exactly these records — file operations, USB activity, print jobs, clipboard use and screenshots — from a single console, and can be scoped to run only during working hours. See what small teams actually use or the pricing.
If it has already happened
Three steps, in order: preserve the records (export them before they age out of retention), establish what was taken and when, then involve counsel before you contact the person. Threatening a former employee in writing, before you know what the evidence shows, is the most common way companies turn a strong case into a weak one.
Related reading: setting up monitoring properly and notice requirements.