The Departure-Cluster Read: Team Lift, Targeted Pull, or Background Churn

Several people have left for the same company within a few weeks, and leadership wants to know by Friday which of three things is happening: one team is being lifted out, the destination is deliberately building a capability, or this is ordinary churn that happens to look like a pattern. This guide is for strategy, research, and talent-intelligence analysts who have to make that call from public profiles and evidence about the destination company. It gives you six scored dimensions, a verdict rule, a confidence level, and a named next action. It works the same way whether the leavers were your people or a rival's.

What is a departure cluster, and what are the three verdicts?

A departure cluster is a group of exits from one source company to one destination, close enough together in time that someone has noticed. The read gives every cluster one of three verdicts: Team Lift, Targeted Pull, or Background Churn.

• Team Lift. A coordinated move of one team, usually organised around a leader and timed so the resignations land together. "Lift-out" is the usual term for this.
• Targeted Pull. The destination is building a capability and recruits people with matching skills from the source company. The hires often come from several teams over several weeks, and the leavers are not coordinating with each other.
• Background Churn. Exits that would happen at roughly this rate anyway, given where people from this function and location usually go.

The verdicts matter because each one leads to different spending. Littler's employer survey of more than 300 US executives found that 92% of employers had seen departures to competitors over the previous 12 months. Among those, some kind of restrictive covenant or confidential information violation happened more than half the time (55%). Coverage of the survey names coordinated "team lift-outs" as an emerging risk. No one publishes the share of employers that see coordinated group departures specifically, so you have no starting assumption about how common lifts are. You have to test the case in front of you.

The public material does not offer that test. Legal writing on lift-outs usually starts after a lift-out is confirmed. Lists of poaching warning signs mention "a sudden cluster" as a red flag but give no threshold for what counts as one. This read comes before both. It is the triage step before anyone calls counsel, approves retention spend, or briefs the board.

Which six dimensions decide the verdict?

Six dimensions decide it: destination concentration against baseline, time clustering, org adjacency, leader-first sequencing, destination build context, and skill specificity. Each scores 0, 1, or 2. Concentration decides whether there is anything to read at all, the next three dimensions measure coordination, and the last two measure the destination's intent.

The cut-offs are my own, not a published standard. Write them into the scoring sheet so the next analyst scores the same case the same way, and only change them deliberately.

What each dimension proves, and how it lies

1. Destination concentration against baseline shows that more people went to this destination than normal flow would predict. It lies when the baseline is company-wide but the leavers all come from one function, or when the destination is a natural sink that absorbs this talent pool anyway.
2. Time clustering shows the exits were synchronised. It lies when the dates come from profile updates, which lag real start dates by weeks and can bunch together after a conference or a layoff announcement.
3. Org adjacency shows the leavers worked together, which a lift requires. It lies when one team is simply the largest pool of that skill, so any recruiter would reach it first.
4. Leader-first sequencing shows that someone organised the move. Groysberg and Abrahams studied more than 40 high-profile moves and interviewed team leaders across industries and countries. They describe the leader discussing the move with the group first to gauge interest. This signal can mislead in two ways. A leader leaving alone is not a lift. And juniors leaving first may be scouting ahead of the leader, which HRZone flags as a possible early warning.
5. Destination build context shows the destination wanted this capability before the hires arrived. It lies when the destination is hiring heavily across the board and your people are a small share of a general hiring burst.
6. Skill specificity shows the destination wanted something only this group had. It lies when leavers rewrite their titles and skills after the move, which makes them look more specialised than they were.

How do you set the baseline for destination concentration?

Set p as the destination's share of the source company's departures from the same function and location over the previous 12 to 24 months. Then compute the binomial tail probability P(X ≥ k | n, p), the chance that k or more of n leavers would go to this destination by normal flow alone. Here n is the number of leavers from that function and location during the cluster window, and k is the number who went to this destination.

A small tail means the cluster would be rare under normal flow. A large tail means you are looking at churn that happens to look like a pattern.

No one publishes a cross-industry figure for the share of a company's leavers that usually go to its single largest destination, so the baseline has to come from the case's own history. Talent-flow views in professional-network analytics tools show which companies a source loses people to and hires from, and the ratio between the two, over the last 6, 12, or 24 months plus the current month. If you do not have access to such a view, rebuild it from public profiles. List everyone who left the source company from the leavers' function and location during the window, record where each person went, and compute the destination's share. Record the top five destination shares at the same time. They tell you whether this destination is unusual or just the usual first stop.

A worked example

With p = 0.05, n = 6 leavers, and k = 4 going to one destination, P(X ≥ 4) is about 0.00009. That is well below the 0.001 line, so it scores 2.

Now suppose you recompute p for the leavers' function alone and find that the destination usually takes a quarter of that function's leavers. With p = 0.25, the same 4 of 6 comes out near 0.04. That scores 1: worth reading, but not proof of anything. The cluster did not change. Only the baseline did.

Natural sinks and market concentration

Some employers absorb a large share of a talent pool whatever else is going on. In Refolk's index of professional profiles, there are 10,245 US profiles titled Machine Learning Engineer and 1,483 in the UK. In a 25-profile sample from each market, Meta is the top current employer in both, with 4 of the 25.

Source: Refolk's index. Shares and ratios are derived from 25-profile samples, so read them as directional only.

The same top share hides two different market shapes. In the US sample, Meta's lead over the next employer is 2x. In the UK sample it is 4x, because no other employer holds more than one profile. Four exits to the dominant employer therefore mean less in the more concentrated market, where that employer is the default next stop.

Two limits apply. First, a 25-profile sample is only directional, so pull a larger sample for the function you are reading. Second, I could not produce a seniority split for this title, because the index's seniority filter does not combine with it. If your leavers are all senior, check senior-level concentration yourself rather than assuming it matches the wider pool.

Why do profile dates mislead the timing read?

Profile dates can lag real start dates by anywhere from about two weeks to three months. That can make separate starts look clustered, and it can make a real same-day exit look spread out. Score time clustering only after widening every profile date, and confirm the dates that drive the score against announcements, press coverage, or resignation records.

No study measures the gap between a start date and a profile update. What exists is career advice and documented platform behaviour, and together they show how wide the error band is.

The posting-delay figure comes from one vendor's internal research, so treat it as indicative. Some people never update their profile at all, which no widening can fix. No source measures the gap between a destination's build signals and the hires arriving either. So do not require postings to come a set number of weeks before the hires. Require only that they are dated and that they come before the cluster or at the same time.

Real coordination compresses timing rather than spreading it out. Under the Protocol for Broker Recruiting, each team member must follow the Protocol steps individually. Many breakaways are deliberately arranged so the new firm's registration goes live on the same day, often a Friday, that the resignations land. HRZone makes the general point that a team poaching attempt usually only works if all the resignations happen at once. So exits confirmed within days of each other are strong evidence of a lift. A spread of several weeks argues against a raid. It does fit a Targeted Pull, though, where the destination hires people one at a time as each accepts.

Step-by-step: scoring a departure cluster by Friday

Seven steps take a list of names to a verdict in roughly a day and a half of analyst time. Each step has a done-state, and you should not start the next step until it is met.

Step 1 takes most of the time, because each leaver's old team, title, exit date, and destination sit on different profiles, posts, and pages. Refolk removes most of that work. You describe the move in plain English, and it returns the people who match from LinkedIn, GitHub, and the open web, each with a source you can paste into the URL column. You still set the date-confidence flag yourself, because a profile date stays low-confidence until something else confirms it.

Step 5 needs care because sources disagree about who moves first. Groysberg and Abrahams describe the leader sounding out the team before the move. HRZone treats junior exits as a possible early warning that the leader is next. Draw the sequence as it actually happened, with dates and reporting lines, and score it only once it is drawn.

LEAVERS
name | old team | title | reports to | exit date | date source | date confidence (high/med/low) | destination | destination title | source URL

BASELINE
source company:
function and location scope:
window (12 or 24 months):
destination share p:
top five destination shares:
n (leavers in cluster window):
k (to this destination):
P(X >= k | n, p):

SCORES (0 / 1 / 2, with evidence)
concentration vs baseline:
time clustering (after 2 to 3 week widening):
org adjacency:
leader-first sequencing (order recorded, leader not assumed):
destination build context:
skill specificity (pre-move evidence only):

lift axis (time + adjacency + sequencing): /6
pull axis (build context + skill specificity): /4
verdict: Team Lift / Targeted Pull / Background Churn
confidence: high / medium / low
next action: counsel / retention / monitor

How do the scores become a verdict, a confidence level, and a next action?

Concentration acts as a gate. After that, two totals decide the verdict: the lift axis (time + adjacency + sequencing, out of 6) and the pull axis (build context + skill specificity, out of 4). Apply the rule in order and stop at the first match.

1. If concentration scores 0, the verdict is Background Churn. The one exception is a lift axis of 6, which you record as Team Lift at low confidence.
2. If the lift axis is 4 or more, the verdict is Team Lift.
3. If the pull axis is 3 or more, the verdict is Targeted Pull.
4. Anything else is Background Churn.

Confidence

Confidence comes from the quality of the evidence, not from how high the scores are. Check three things:

• The concentration test used a function-and-location baseline, not a company-wide one.
• Every date that changed the time score was confirmed by a source other than a profile.
• No skill or title score depends on profile text edited after the move.

All three is high confidence, two is medium, and one or none is low. A low-confidence Team Lift is still routed as a Team Lift. It goes to counsel with the low-confidence label attached.

Why a Team Lift goes to forensics before retention

The risk of losing data is bigger than the risk of losing headcount. In the Littler survey, the most common violation when employees left for a competitor was taking confidential information, ahead of every contractual breach.

Where a violation happened, 95% of employers took some action and 35% went to litigation. If the read lands on Team Lift, the first thing to find out is what the leavers had access to and whether any of it left with them. Retention offers to the people who stayed come second.

When the leavers were a rival's

The scoring stays the same when you are watching a competitor's people leave for a third company. Only the next actions change. A Team Lift means one of the rival's teams has been hollowed out. A Targeted Pull means the destination is building a capability you may soon compete against. Background Churn means neither, and the brief should say so plainly.

Subject: Departure cluster, [source company] to [destination]: [verdict], [confidence] confidence

What happened
[k] of [n] leavers from [function, location] went to [destination] between [first exit date] and [last exit date].

Is it more than chance?
Baseline: [destination] took [p as a percentage] of this function's leavers over the previous [12 or 24] months.
Probability of [k] or more of [n] by normal flow: [value]. Concentration score: [0/1/2].

Scores
Time clustering [0/1/2] | Org adjacency [0/1/2] | Sequencing [0/1/2]
Build context [0/1/2] | Skill specificity [0/1/2]
Lift axis [x]/6 | Pull axis [y]/4

Verdict: [Team Lift / Targeted Pull / Background Churn]
Confidence: [high / medium / low], because [which of the three evidence checks passed]

Next action: [counsel and forensic access check / retention review / monitor]
Owner: [name]. Re-run trigger: [next exit to destination / date confirmed or contradicted / destination announcement]

What would change this verdict
[One or two specific pieces of evidence]

How does the departure-cluster read go wrong?

It goes wrong in seven ways, and most of them produce false positives that make churn look like a raid. Check every verdict against each of these before you sign it off.

1. Concentration against the wrong baseline

• What it looks like: a tiny tail probability computed against company-wide flow, while every leaver sits in one function.
• Why it happens: where people go varies by geography and function, so a company-wide p understates how often this function goes to this destination.
• Check: recompute p for the leavers' function and location only. If the score drops from 2 to 1 or 0, the first number was the mistake.

2. Time clustering that is really update lag

• What it looks like: four profiles that all show the same start month.
• Why it happens: people often update in the same week, for example after a conference or a layoff announcement.
• Check: confirm the dates against announcement posts or press coverage, not the month field on the profile.

3. Natural sinks

• What it looks like: a large share of leavers going to the employer that dominates the talent pool.
• Why it happens: a dominant employer absorbs exits anyway. In Refolk's index, Meta holds 16% of the Machine Learning Engineer sample in both the US and the UK.
• Check: compare the destination's share of your leavers with its share of the whole pool. If the two are similar, the destination is a sink, not a raider.

4. Leader-first read backwards

• What it looks like: the leader left last, so the analyst scores sequencing 0.
• Why it happens: juniors who leave first may be scouting ahead of the leader.
• Check: score the sequence without assuming who leads. A leader inside a tight cluster scores at least 1 regardless of order.

5. Mistaking a hiring burst for a targeted build

• What it looks like: the destination has a flood of new postings and announcements, and your people are among the hires.
• Why it happens: the destination is hiring broadly, and your company is one source among many.
• Check: work out what share of the destination's recent hires in that function came from the source company. Ask Refolk for the destination's recent hires in that function, then for the subset who previously worked at the source, and you have both numbers from two queries instead of a day of reading profiles.

6. Retroactive edits

• What it looks like: leavers whose old roles now list exactly the skills the destination advertised.
• Why it happens: people rewrite titles and skills around a move. Research on retroactive profile edits, sometimes called "time travel", finds they double shortly before people change jobs.
• Check: score skill specificity from the earliest version of each profile you can find, from announcements made before the move, or from internal role records for your own leavers.

7. Legal drift

• What it looks like: the departure list gains a tab called "people likely to follow".
• Why it happens: once the tooling exists, watching current staff feels like a natural next step.
• Check: limit the scope to people who have already left. The next section explains why.

What is this analysis allowed to become?

This read covers people who have already left, using public evidence about where they went. It must not turn into ongoing surveillance of current employees. Whether a particular jurisdiction's employee-monitoring rules apply to your version of the analysis is a question for counsel, not for this guide.

Three facts set the boundary:

• Data protection authorities hold that publicly accessible personal information is still subject to data protection and privacy law in most jurisdictions. The follow-up joint statement on data scraping came from Australia's privacy regulator, the OAIC, and 16 counterparts, including the UK ICO, Canada's OPC, Hong Kong's PCPD, and Switzerland's FDPIC.
• In the US, the Ninth Circuit held in hiQ v. LinkedIn that scraping a publicly accessible website does not violate the federal Computer Fraud and Abuse Act. hiQ still lost on LinkedIn's breach-of-contract and trespass claims, and agreed to a $500,000 judgment and a permanent injunction.
• hiQ's product "Keeper" flagged employees at risk of leaving. That is where a departure-cluster dataset ends up if nobody draws the line.

I have not verified how GDPR employee-monitoring guidance, or its equivalents elsewhere, applies to this kind of analysis. If your leavers or your analysts are in such a jurisdiction, ask counsel before keeping the dataset beyond the decision it was built for.

How do you keep the read current after Friday?

Treat the verdict as dated, not final. Re-run the read when a new exit to the same destination appears, when a date you scored from a profile is confirmed or contradicted, or when the destination publishes something that changes its build context.

Re-scoring is cheap if the scoring sheet was kept properly: add the new row, update n and k, rerun the tail, and redraw the sequence. Two habits keep it honest:

• Fix the baseline window for each read. Then a re-score reflects new evidence, not a moved goalpost.
• Re-check the timing delays yourself from time to time. The way the lag works is stable, but its size depends on platform behaviour and on how people choose to update. To check, take a few announced hires with known start dates and note how long their profiles took to change.

Keep a short watch on Background Churn verdicts. A Targeted Pull often looks like churn at first, with one or two exits weeks apart. The pattern only becomes clear when a third person goes to the same place.