TTX-04 · Scenario card
Insider Threat Tabletop: The Departing Privileged Engineer
An insider threat tabletop exercise: a privileged engineer resigns and copies data to personal cloud storage. 8 injects for HR, legal and security together.
Insider incidents are uncomfortable to exercise because the "attacker" is a colleague. That discomfort is exactly why they are worth rehearsing. The technical response is often straightforward; what goes wrong is coordination between HR, legal, security and management, and the pressure to act fast without breaking employment or privacy law.
This scenario models a common pattern: a privileged employee resigns to join a competitor and, in the weeks before leaving, copies large amounts of sensitive data to personal cloud storage. It tests joiner-mover-leaver processes, the limits of monitoring, evidence handling and the decision of when and how to confront the employee.
Scenario at a glance
| Threat | Malicious or negligent insider: data exfiltration by a departing privileged employee |
| Difficulty | Intermediate |
| Duration | 2 hours including a 20-minute hotwash |
| Audience | HR, legal, security and the business line manager |
| Recommended participants | HR business partner, employment counsel, privacy/DPO, security or IR lead, IT identity and access lead, the employee's line manager's manager, communications (optional) |
| Prerequisites | Acceptable-use and monitoring policies, leaver process, data classification scheme, any works-council or union agreements on monitoring |
| MITRE ATT&CK techniques | T1078 Valid Accounts, T1213 Data from Information Repositories, T1567.002 Exfiltration to Cloud Storage |
Exercise objectives
- Confirm that security, HR and legal know how to convene a need-to-know insider response group and who leads it.
- Test the leaver process for privileged staff: when access is reduced and removed, and who decides.
- Identify what monitoring and investigation steps are lawful and permitted by policy, and who approves expanding them.
- Validate evidence-handling practices so that findings could support disciplinary or legal action.
- Agree how and when to engage the employee, and what to do if they have already left.
Starting situation
Read this aloud to players:
It is Monday, 09:30. A senior platform engineer, with administrator access to the source code repositories and production infrastructure, handed in their resignation on Friday. They have four weeks' notice and have told colleagues they are joining a direct competitor.
The engineer is well liked and has been with the company for six years. Your organisation has a data loss prevention (DLP) tool on corporate laptops and logs activity in its cloud collaboration platform.
Injects timeline
| # | Time | Inject | Delivered to | What players should address |
|---|---|---|---|---|
| 1 | T+00:00 | HR processes the resignation; the leaver checklist schedules access removal for the last day | HR → IT | Leaver process for privileged roles |
| 2 | T+72:00 | DLP alert: 18 GB uploaded from the engineer's laptop to a personal cloud storage service over the weekend | Security | Triage, confidentiality, who is told |
| 3 | T+74:00 | Security wants to review the engineer's email and chat; HR asks whether that is allowed | Security / HR → legal | Lawful monitoring, approvals |
| 4 | T+76:00 | Repository audit logs show the engineer cloned 40 repositories, including ones outside their team | Security / IT | Scope, access justification |
| 5 | T+78:00 | The line manager, told informally, wants to confront the engineer today | HR / line manager | Tipping off, interview strategy |
| 6 | T+96:00 | The engineer's access is found to include a personal API token with admin scope on the code platform | IT identity lead | Hidden access paths, revocation |
| 7 | T+120:00 | The competitor's CEO emails your CEO praising the engineer's "impressive preparation" | Executive / legal | Legal options, communications |
| 8 | T+240:00 | After the engineer leaves, a colleague reports the engineer still has access to a shared operations chat channel | IT / security | Residual access, third-party platforms |
Module 1 — Resignation and first signal (T+00:00 to T+74:00)
Inject 1. HR processes the resignation. The standard leaver checklist schedules account deactivation for 17:00 on the last working day. No changes to access are made in the meantime.
Inject 2. Monday morning, the DLP console shows that over the weekend the engineer's corporate laptop uploaded 18 GB to a personal cloud storage service. The file names include architecture documents, customer lists exported from the CRM and several source-code archives.
Inject 3. The security lead wants to review the engineer's corporate email and chat history for the last month. The HR business partner asks: "Are we allowed to do that? What did we tell employees about monitoring?"
Discussion questions:
- Does your leaver process treat privileged or high-risk roles differently? Who decided the access timeline?
- Who is told about the DLP alert, and who must not be told yet? How do you keep the circle small?
- What do your policies say about monitoring employee communications? Who approves an expanded review?
- Could there be an innocent explanation (for example, a personal backup habit)? How do you keep an open mind while preserving evidence?
Module 2 — Investigation and access (T+76:00 to T+96:00)
Inject 4. Repository audit logs show the engineer cloned 40 repositories in the past two weeks, including several belonging to teams they have never worked with.
Inject 5. The engineer's line manager has heard rumours and wants to "have it out" with the engineer this afternoon. They think it's a misunderstanding.
Inject 6. While preparing to reduce access, the IT identity lead discovers the engineer created a personal access token on the code platform with administrator scope a year ago. It does not expire and is not tied to single sign-on.
Discussion questions:
- How do you preserve evidence properly: logs, the laptop, DLP records? Who does it, and is chain of custody documented?
- Should access be reduced now? What could the engineer do if they notice, and does reducing access tip them off?
- What are the risks of the line manager confronting the engineer? Who should conduct any interview, and with whom present?
- How many other long-lived tokens or local accounts exist outside single sign-on? How would you find them?
Module 3 — Escalation and departure (T+120:00 to T+240:00)
Inject 7. Your CEO receives a friendly email from the competitor's CEO praising the engineer's "impressive preparation for their new role". The CEO forwards it to legal: "What does this mean? What can we do?"
Inject 8. Two weeks after the engineer's departure, a colleague mentions that the former engineer is still active in a shared operations channel on an external chat platform used with a hosting partner.
Discussion questions:
- What legal options exist (for example, a letter reminding the employee of confidentiality obligations, or a request to return and delete data)? Who decides, and on what evidence?
- Should the competitor be contacted, and by whom?
- Is any of the copied data personal data (for example, the customer list)? Does that create privacy notification obligations?
- How do you find all the external platforms, shared channels and third-party accounts a leaver can still access?
- What changes to the leaver process come out of this?
Discussion questions
- Governance: Is there a standing insider-risk group, or is it assembled ad hoc? Who chairs it?
- Proportionality: Where is the line between protecting the company and respecting employee privacy? Who draws it?
- Access hygiene: Which access paths bypass single sign-on and are therefore missed by standard deprovisioning?
- Evidence: Would your evidence stand up if the case went to court or to an employment tribunal?
- Culture: How do you handle this without creating a climate of suspicion for remaining staff?
Curveballs / optional injects
- The engineer claims whistleblower protection, saying the files document a safety or compliance issue.
- The engineer is on sick leave and cannot be contacted.
- The DLP alert turns out to be partly a false positive: some uploads were to a sanctioned corporate storage tenant with a similar name.
Facilitator notes
Expected decisions. A mature team convenes a small group with HR, legal and security within hours of the DLP alert; legal advises on permissible monitoring before it expands; evidence is preserved before any confrontation; privileged access is reduced in a planned way that balances the risk of tipping off against ongoing exposure; any interview is planned, with HR present.
Common pitfalls.
- Security reviewing mailboxes without legal or HR approval, creating legal exposure and tainting evidence.
- The line manager tipping off the employee.
- Deprovisioning only the directory account and missing tokens, local accounts and external platforms.
- Treating the situation as purely technical, or purely HR.
Sensitivity. Remind players that the scenario is fictional and not about any real colleague. If your organisation recently had a real insider case, consider a different scenario or adjust details substantially.
Adapting the audience. For an HR/legal-heavy group, reduce technical detail and focus on injects 3, 5 and 7. For a technical group, expand inject 6 into a discussion of identity governance and discovery of non-SSO access.
Evaluating the exercise
| Capability | What good looks like | Red flags |
|---|---|---|
| Insider response governance | Need-to-know group with HR, legal and security convened quickly | Security acts alone; wide circulation |
| Lawful investigation | Monitoring scope approved by legal and consistent with policy | Mailbox review "because we can" |
| Evidence handling | Logs and devices preserved with documented chain of custody | Laptop reimaged at return |
| Access removal | Risk-based timing; all access paths including tokens and external platforms | Directory account only; access persists after departure |
| Employee engagement | Planned interview with HR present, after evidence is secured | Informal confrontation, tipping off |
| Legal follow-up | Clear options and decision owner for legal action | No one owns the decision |
Related
Frequently asked questions
Who should lead an insider threat investigation?
Usually a small, need-to-know group with representatives from security, HR and legal, with legal counsel guiding what can be monitored and how evidence is handled. Security should not act alone, because employment law, privacy law and works-council or union agreements may constrain monitoring and interviews.
Can we monitor an employee we suspect of taking data?
It depends on your jurisdiction, your policies and what employees have been told. Many countries require monitoring to be lawful, necessary and proportionate, and some require consultation with employee representatives. The exercise should test whether your team knows to ask legal before expanding monitoring, not assume the answer.
When should a departing employee's access be removed?
For high-risk roles, access is often reduced as soon as resignation is received and fully removed at or before the last working moment, with privileged and remote access removed first. The exact timing is a policy decision that HR, IT and the business should agree in advance rather than improvise.