Insider Signals in Handover Week — What Delivery People Notice

The leaver had two weeks left. In the handover huddle she offered what every competent analyst offers under that calendar: a knowledge pack. Customer contact extracts for the open defects, the shared ops_readonly password still sitting in the team wiki "until the replacement starts on Monday," and a private Slack canvas with the API keys the secrets-vault ticket would not clear before Friday. Nobody in the room flinched. It sounded like professionalism.

It was also the week the team created the most unsupervised copies of operational data it had made all quarter.

That is the signal delivery people actually see — not a hooded stranger, but a helpful colleague compressing continuity into the days before they go.

Handover Week as a Risk Concentrator

Handover week is not a special attack season. Same ordinary habits any delivery team already practises — exports for investigation, temporary access, workarounds around slow tickets — only now they are pressed into a shorter window by a leaving date.

On an ordinary Tuesday those habits appear one at a time. In a notice period they arrive as a bundle, because the pack is supposed to be finished before the person disappears.

Continuity pressure does the compressing. The replacement may not have started. The open defects still need owners. Sponsors still expect the programme to move. Under that pressure, "just for the week" becomes the default grammar of access, and the knowledge pack becomes a licence to move data into wherever the next person will find it.

CERT's case work on insider intellectual-property theft has long pointed at the same calendar shape: many of those who took IP took at least some of it within thirty days of termination. You do not need to cast every leaver as a thief to hear the useful part of that finding. Departure proximity concentrates movement. Delivery teams live inside that proximity every time a notice period begins.

There is a second pressure that tooling rarely names: social reluctance. Challenging a departing colleague's offer of help feels ungrateful. The room wants a clean goodbye. Naming risk in that atmosphere costs more socially than leaving the shared password where it is.

So the week concentrates risk without anyone intending to.

The calendar is the amplifier.

Three Signals Delivery People Already See

Stay with that logistics CRM team through the notice period and the signals are almost boring — which is why they matter.

Exports for the knowledge pack

The first signal is the export spike dressed as documentation. Contact lists for open tickets. Order histories "so the next analyst can see the pattern." A prod extract on a personal OneDrive "so nobody is blocked if IT locks the account on Friday afternoon."

On that team the pack grew in three days: a filtered customer list for the address-format defect, a month of exception orders for the receiving queue, and a screenshot thread of real names in Slack so the wider group could "see what she meant." None of it was theft theatre. All of it left the CRM's audit trail.

Each file has a continuity story. Each file is also a new home for data outside the system that was meant to govern it. The Tuesday export habit is familiar to anyone who has chased a defect against a deadline. Handover week multiplies it, because completeness becomes a leaving gift.

Shared accounts "just for the week"

The second signal is uglier because it looks administrative. The shared login that was always a little wrong suddenly becomes necessary. The wiki still holds ops_readonly. Someone says the replacement will get their own account next sprint. Everyone nods, because the alternative is a freeze on Monday morning.

UK guidance is plain on this point: sharing work accounts loses the ability to audit whose hands were on the keys, and if someone is no longer allowed access, the password should be changed. The continuity story does not cancel that. It explains why the story wins in the huddle.

Quiet workarounds when tickets will not close

The third signal is the temporary exception that races the last day. The secrets vault ticket is still open. MFA enrolment for the contractor replacement is stuck. So keys land in a private canvas, or a personal password manager, "until the proper path catches up."

Temporary by design is how these workarounds sell themselves. Permanent by neglect is how they finish. The person who created them is gone; the canvas remains. Six weeks later the replacement is still using it, because rotating secrets now looks like an outage risk rather than unfinished offboarding.

None of the three requires malice. All three are visible to BA, QA, developers, and support sitting in the same room. The SOC may see the bulk transfer later. Delivery people hear the proposal first.

The Continuity Story — Why Helpfulness Hides Risk

The dangerous behaviour usually arrives wearing a helpful face. That is why peers stay quiet.

"I'm leaving you everything you need" is a professional sentence. "We should not put customer exports on a personal drive" sounds, in the same meeting, like accusing someone who is trying to do right by the team. The social asymmetry is the camouflage.

People route around controls that collide with the job in front of them. That is not a character flaw; it is what happens when the sanctioned path will not finish before Friday and the programme still has a date. Handover week is that collision at full volume. The dirt track is the shared password and the CSV.

Naming the signal without prosecuting the leaver is the discipline. The target is the system pressure — compressed continuity, slow tickets, missing named accounts for the replacement — not the person packing their desk.

If you cannot say the sentence out loud without turning it into a character judgment, you do not yet have a usable noticing habit. You have a suspicion. Suspicions do not travel well in a goodbye week.

Delivery Notice Versus Theatre

Insider-risk conversation still defaults, too often, to nation-state theatre: sophisticated adversaries, exotic exfiltration, a drama that flatters the reader with the scale of the threat.

Delivery people are watching a different film. They see the knowledge pack, the wiki password, the canvas of keys. Those are the signals that arrive before revocation checklists and after the programme still needs to run.

IT offboarding still matters — tokens back, accounts disabled, access gone on the day of departure. That is necessary work. It is also incomplete for the week before departure, when the helpful exports and temporary shares are proposed as care for the team that remains.

The identity claim is simple, and it is one a delivery person can own without a SOC title: you are often the earlier sensor for this class of risk. Not because you are a detective. Because you are in the huddle where the continuity story is told.

Treat that as a people skill. Learn to hear the three signals. Ask the plain questions while the person is still there to answer them. Leave the cinematic adversary for someone else's slide deck.

One Noticing Habit for the Next Leaver Week

You do not need a new product to practise this. You need three questions spoken aloud in the handover huddle, in the same register you use for defect triage:

• Where will the knowledge-pack files live after Friday, and who owns deleting them?
• Which shared passwords or group logins does this person still know, and when do we rotate them?
• What temporary exceptions are we accepting because a ticket will not close in time — and what is the named end date?

Ask them as coordination, not accusation. Put the answers where the team already keeps decisions. On the replacement's first Monday, open that note again — before the temporary exception becomes how the team works.

Nation-state stories make risk feel distant and thrilling. Handover week makes it local — and dull enough to act on.