All tabletop exercises
Insider·Intermediate·Mixed audience
A departing engineer clones every repository the week before resigning
The prompt — read this to the room
A senior engineer at a 250-person fintech hands in her notice on Friday, saying she is joining a competitor. On Monday a routine review of source-control audit logs shows her account cloned 140 repositories in the ten days before she resigned, including the fraud-scoring models she never worked on. Her work laptop also synced to a personal cloud drive twice last week. She is still working her notice period, has production access, and is well liked. HR wants to handle it quietly. Legal wants evidence first. What happens today?
Total duration
1 h 45 min
People to involve
6
Best fit
Finance, Saas
Who to involve
Most important first.
- HR
- Legal counsel
- CISO / Head of security
- SOC analyst
- Developer / DevOps
- CIO / CTO
What it tests
- Run an insider investigation that is lawful, proportionate and fair to the employee.
- Preserve evidence well enough to support legal action if it is needed.
- Reduce access risk during the notice period without tipping off or prejudging.
- Agree who decides, and how security, HR and legal share information.
Outline of activities
- 1The audit-log finding and the employee’s context
- 2Evidence first: what to collect, by whom, under what authority
- 3Access during notice: restrict, garden leave or watch
- 4The conversation with the employee and the competitor angle
- 5Leaver process gaps and fixes
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…