Insider Data Theft Lab
An engineer resigns on Monday. By Thursday night 36 GB of designs and pricing has gone to a personal cloud account. Make the calls — confront or preserve, block or wait, monitor how far, remove access when — and see what happens to the evidence, the data and the person.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
a senior design engineer handed in their resignation on Monday and is joining a competitor. On Friday morning the data-loss-prevention queue shows something you do not like. Make the calls as security lead — with HR and legal, or without them — and see what happens to the evidence, the data and the person.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- A realistic insider case with DLP, cloud-app and code-platform log lines: resignation, repository clones and large uploads to a personal cloud account.
- Branches change the story: confronting early leads to a shredded and "lost" laptop; logging into the personal account puts the whole case at risk.
- Each decision is scored 0–10 with feedback on evidence, employment process, privacy law and notification clocks — and "check with counsel" where the answer depends on the country.
- Rename the organisation and the subject so the debrief fits your context. Free to play; exporting the debrief is part of any PlayCISO plan.
Frequently asked questions
What should security do first when an employee may be taking data?
Brief HR and employment counsel and preserve server-side logs before anyone contacts the person. If critical data is still leaving, apply a narrow block that stops the harm without changing everything else.
Can we look inside the employee's personal cloud account?
Not on your own authority. Accessing someone's private account, even with a password saved on a company device, can be unlawful and can make the evidence unusable. Recovery from personal accounts goes through counsel and, if needed, the courts.
Is insider data theft a data breach?
It can be. If personal data — customer contacts, staff records — left with the insider, run the breach notification assessment in parallel with the employment case. Under GDPR a notifiable breach goes to the supervisory authority within 72 hours of becoming aware.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.