ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: AF028.002
  • Created: 06th October 2025
  • Updated: 08th October 2025
  • Contributor: The ITM Team

Unauthorized Leave

The subject avoids investigative scrutiny by failing to report to work without formal authorization, also known as Absence Without Leave (AWOL). This may occur immediately after detection avoidance behaviors or in anticipation of policy enforcement. By going dark, the subject hinders interview scheduling and limits organizational recourse under standard HR workflows. This tactic may also serve to buy time for evidence destruction, off-site data transfer, or the coordination of third-party narratives.