SMB Tech & Cybersecurity Leadership Newsletter

SMB Tech & Cybersecurity Leadership Newsletter

The Fired Developer’s "Kill Switch": Why Offboarding is Your Strongest Defense

Christophe Foulon 📓's avatar
Christophe Foulon 📓
Dec 20, 2025
∙ Paid

A former developer at Eaton Corp was recently convicted for embedding a "deadman’s switch" that sabotaged systems immediately after his termination. For SMB leaders, this case is a stark reminder that cyber defense isn't just about blocking external hackers; it is equally about robust, immediate, and automated offboarding of internal access.

kill switch in code

• The Inside Threat is Often the Greatest Risk: Unlike an external breach, a disgruntled employee already has the keys to the kingdom. In this case, the developer spent months writing malicious code—specifically named "Is Davis Lu Enabled in Active Directory"—to delete files and lock users out if his status ever flipped to "no."

• Automation is Your Shield: Manual offboarding processes are prone to human error and delays. If your systems are integrated and automated, you reduce the window of opportunity for "parting gifts." However, as this case shows, you must also monitor for unauthorized changes to system logic before the depar…

User's avatar

Continue reading this post for free, courtesy of Christophe Foulon 📓.

Or purchase a paid subscription.
© 2026 Christophe Foulon · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture