PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Technical team continuity: who can operate when the specialist is away?
Use the PERM announcement as a prompt to review dependence on individuals, without inferring risk from a worker's nationality.
By Pentesty
The news is context, not a finding about employees
CyberSec Brazil reported the announcement of PERM processing suspensions involving technology employers in the United States. The White House published the recording of the October 8, 2026 press conference. This article uses the event as context for team continuity. It does not interpret individual immigration cases or presume that any particular professional will become unavailable or pose a security threat.
Evaluate dependency on individuals consistently
Absence, leave, role changes and contract termination can expose the same weakness: an essential service has only one capable operator. Review role, privilege and service criticality. Nationality or immigration status does not establish malicious intent and cannot replace a technical assessment of access.
Choose one service and ask who could recover it when the usual specialist is unavailable. The answer should cover authorized access, procedural knowledge and the ability to validate the outcome. An alternate named in a spreadsheet may still be blocked by a personal account, an unknown secret or a critical step that was never documented.
Make documentation independently executable
A useful procedure identifies prerequisites, decision points, approved actions, stopping conditions and validation criteria. It does not need to reproduce the entire architecture, but should point to the information needed without placing secrets in plain text. Access to the recovery documents themselves is part of the recovery design.
Ask a second authorized operator to execute the workflow in a test environment without continuous guidance from its author. Record every point requiring help and update the procedure. This distinguishes transferred knowledge from a file that merely exists and reveals permissions that still depend on improvised intervention during an incident.
Rehearse before a real staffing transition
During a planned exercise, assume the specialist cannot participate. Evaluate the service design rather than the individual. Measure the time required for the alternate to obtain authorization, find the procedure, perform the action and validate recovery. Convert obstacles into owned actions with deadlines rather than relying on informal promises to document them later.
Pentesty's analysis is that knowledge continuity and access control need to evolve together. Broadly granting more administrators can reduce one dependency while creating another exposure. An authorized assessment can validate permissions and technical paths within the agreed scope. Preparing operators, approving transitions and maintaining procedures remain organizational responsibilities.
Include the business owner when accepting the result. Technical recovery is useful only if the restored service supports the required activity, and that owner should understand remaining dependence on unavailable expertise or provider assistance.
Frequently asked questions
Does immigration news establish an insider threat?
No. Assess access risk through role, permissions and evidence of behavior or exposure. Nationality and immigration status do not establish malicious intent.
Is sharing the administrator password with a second person enough?
Shared credentials weaken attribution. Prefer individual identities, approved permissions and a recovery procedure that the alternate has demonstrated they can execute.
How do we know the documentation works?
A second authorized operator should execute the procedure in a test environment and validate the result. Record questions, dependencies and required interventions, then update the procedure.
What should be reviewed when a contract ends?
Individual access, sessions, tokens, service accounts and integrations associated with the work, with continuity owners assigned. Preserve operations while removing permissions no longer required.
Sources and references
Original Pentesty analysis, published October 15, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.