SolidBowtie

Insider data exfiltration

A trusted insider walking out with crown-jewel data — motive meets opportunity, caught by least privilege, monitoring and offboarding.

HazardEmployees and contractors with legitimate access to sensitive data
Top eventSensitive data leaves the organisation without authorisation

4 threats 14 barriers 3 consequences safety-critical barriers marked

Use this template free. Copy “Insider data exfiltration” into your own workspace and adapt every barrier — no credit card.

Start free with this template →

Threats & preventive barriers

Each threat is a credible pathway to the top event; its barriers interrupt that pathway before control is lost.

Disgruntled employee with broad access

  • Least-privilege & need-to-know access (A.5.15) ★ critical

    Socio-technical · 75% effective · Owner: IAM Lead

    Role creep accumulates entitlements

  • User behaviour analytics on data access (A.8.16)

    Continuous · 65% effective · Owner: SOC Manager

  • Speak-up culture & HR early signals

    Behavioural (human) · 55% effective · Owner: HR Director

Departing staff taking data to a competitor

  • Same-day offboarding & access revocation (A.5.18) ★ critical

    Socio-technical · 80% effective · Owner: HR Operations

    📅 Leaver access audit · monthly keep-alive task

  • Exit interviews with confidentiality reminder

    Behavioural (human) · 50% effective · Owner: HR Director

Contractor with excessive third-party access

  • Time-boxed contractor accounts (A.5.19)

    Socio-technical · 75% effective · Owner: IAM Lead

  • Supplier confidentiality agreements (A.5.20)

    Socio-technical · 60% effective · Owner: Legal Counsel

Bulk export via removable media or personal cloud

  • DLP on endpoints & egress (A.8.12) ★ critical

    Active hardware · 70% effective · Owner: Security Engineering Lead

    Personal devices outside DLP scope

  • USB & personal-cloud blocking (A.7.10 / A.8.19)

    Active hardware · 80% effective · Owner: IT Operations Manager

Consequences & recovery barriers

Once the top event happens, recovery barriers limit each consequence.

Trade secrets reach a competitor

  • Watermarking & document classification (A.5.12)

    Socio-technical · 60% effective · Owner: CISO

  • Legal response & injunction playbook

    Socio-technical · 65% effective · Owner: Legal Counsel

Personal data breach with notification duty

  • Breach notification within 72h (A.5.26) ★ critical

    Socio-technical · 85% effective · Owner: Data Protection Officer

  • Forensic readiness & audit logging (A.8.15)

    Continuous · 75% effective · Owner: SOC Manager

Reputation damage with customers

  • Transparent customer communications

    Behavioural (human) · 70% effective · Owner: Communications Director

Copying this template gives you a fully editable bowtie: barrier owners arrive as role suggestions, escalation factors sit on their barriers, and keep-alive activities are scheduled from the moment you copy. New to the notation? Read what the bowtie method is or browse the practical guides.

Use this template free. Copy “Insider data exfiltration” into your own workspace and adapt every barrier — no credit card.

Start free with this template →