Playbook
Departing employees are a known leak vector and we have no detection
After a high-profile case where a departing executive took customer data to a competitor, the CISO needs visibility on the pre-departure behaviour pattern. Purview Insider Risk would surface the signal but the team has never deployed it; HR and Security do not currently share the joiner-mover-leaver signal.
Trigger — Recent leak incident; board attention; HR-Security co-ordination gap.
Good outcome — Insider Risk policy live for HR-flagged departures, signals into Sentinel, weekly cross-functional review cadence with HR + Legal + Security.