The First 48 Hours

Your IT admin sees your Slack go dark. Your calendar events aren't being accepted. Your commits stop. Your last login was days ago.

They know before your family tells the company. And in those 48 hours, before anyone is officially notified, a lot can happen:

• Source code export — git clone the entire codebase • Customer data download — export CRM, user databases • Credential harvesting — copy saved passwords, API keys, admin tokens • Financial access — initiate unauthorized transactions • IP theft — download trade secrets, proprietary algorithms

You'd like to think your employees are loyal. Most are. But it takes only ONE bad actor in a moment of opportunity to cause irreversible damage.

The Leadership Vacuum Is an Invitation

Insider threat research consistently shows that unauthorized access spikes during organizational transitions — mergers, layoffs, and especially after the departure (or death) of a key leader.

Why?

• Normal oversight is disrupted • Nobody is checking the access logs • Staff assume "nobody is watching" • The person who set the security policies is the person who's gone • Emotional turmoil reduces vigilance

The longer the leadership vacuum persists, the more exposure you have.

The Lockdown Protocol

Create a ZeroLatch vault containing a "Lockdown Protocol" for your most trusted lieutenant (COO, VP Eng, or IT manager):

If I don't check in for 48 hours, execute immediately:

1. Revoke all admin access — rotate root passwords on AWS, GCP, domain registrar
2. Freeze code repositories — set repos to read-only, disable force push
3. Monitor egress — enable DLP alerts on all file-sharing services
4. Lock financial accounts — notify the bank, freeze corporate cards
5. Notify the board — send pre-drafted succession notification
6. Preserve evidence — snapshot all servers, export all access logs

This isn't about distrust. It's about removing temptation during a vulnerable period. Your legitimate team members will understand. Your illegitimate ones will be stopped.