Ninety-three percent. That’s how many organizations had serious data loss involving a departing employee, according to Proofpoint’s 2026 Voice of the CISO survey of 1,600 security chiefs.

Most people immediately think of someone deliberately stealing secrets. But the reality is usually less dramatic and, more importantly, much harder to notice.

A well-liked account manager quits and, in their last two weeks, emails some templates to themselves, exports their contacts, and saves the pitch deck they’re proudest of.

If you called it theft, they’d be upset. Often, data doesn’t leave with a thief. It leaves with someone who believes it was theirs all along.

 

A line nobody drew

That doesn’t mean every insider threat is just an honest mistake.

Proofpoint’s respondents say malicious insiders are still the main cause of data loss, and it’s risky to ignore them.

But the bigger issue is people who really believe the work is theirs. In a 2022 Tessian survey, 40 percent of US workers admitted to taking data from a previous job, and more than half said they had worked on it, so it belonged to them.

This habit hasn’t gone away.

In a recent Sagiss survey, 71 percent said company information was still somewhere they controlled after leaving, and 16 percent had it in an AI tool.

When there’s no clear rule, people make up their own: I built it, so I take it with me.

That gap comes from the organization itself.

Few companies explain where “my work” stops and “company data” starts, and the first real talk often happens only after the data is already gone.

Fewer decisions, higher stakes

It’s easy to assume that as AI takes on more of the work, the human side of security shrinks. In reality, the opposite happens. When automated systems handle the routine threats, what reaches people are the tricky ones: the payment request that looks almost right, the urgent message from a colleague who isn’t quite who they seem, the video call that feels slightly off. Those moments are rarer, but the stakes are far higher.

“As technology and cyber environments get more complex, we can’t keep training people the way we did ten years ago,” said Ori Attar, Cywareness CEO. “The way people understand, experience, and respond to cyber challenges has to evolve just as fast as the tools around them.”

 

The ticking clock

The countdown starts when someone gives notice and ends when they hand back their laptop.

Carnegie Mellon’s CERT researchers found that many people who took intellectual property did so in the month before or after leaving. During the notice period, all accounts stay active. Managers plan the handover, colleagues set up farewell drinks, and the person leaving quietly sorts through years of work, deciding what to keep.

HR takes care of the people side, IT shuts down accounts on the last day, and security is rarely involved, so the weeks between notice and leaving often go unmanaged.

It’s not easy. When work was kept in filing cabinets and office servers, it was easier to see what left the building. Now, with remote work, cloud tools, and AI assistants, company material is spread across personal drives, messaging apps, and chat histories that offboarding checklists can’t always catch.

When someone leaves, what actually gets revoked?

 

Planning the exit before the exit

The answer is planning.

With the right process, you don’t have to treat anyone leaving as a suspect, because the risk is managed before anyone resigns. Without a plan, every leaver could be a way for data to get out.

Draw the line at onboarding and repeat it through the years: what belongs to the company, and what is genuinely the employee’s, from their skills and network to a portfolio agreed in advance.

People respect a boundary that was actually shown to them.

Let the resignation, not the last day, trigger offboarding. Hold a short, respectful conversation about what to hand over, delete, and keep, so you remove the “I didn’t know” defense without making anyone feel accused. Map where the work really lives, including SaaS tools, shared links, personal devices, and AI accounts. And for layoffs, plan the exit before it is announced.

 

A confession

It’s only fair to be honest after all this.

When I last left a job, I took a few files with me: a template I was proud of and a deck I thought I might use again. No one told me not to, and it never crossed my mind that it could be theft. Until now, of course.

I doubt I’m the only one, and that’s the real problem. The people leaving with your data aren’t strangers. Many of them are just like us.

This article was written by Cywareness, a company specializing in cybersecurity awareness.

As part of its mission, Cywareness continues to monitor emerging trends, analyze real-world attacks, and share practical insights to help organizations stay ahead in today’s evolving threat landscape.