When Employees Leave: The Access That Stays Behind

In April 2018, an engineer resigned from Cisco. Five months later, he logged into the company's cloud infrastructure and deleted 456 virtual machines, knocking out more than 16,000 WebEx Teams accounts for up to two weeks. Restoring service cost roughly $1.4 million in engineering time plus over $1 million in customer refunds, and the U.S. Department of Justice eventually sent him to prison for two years. The detail that should worry every security leader is not the damage — it is the timeline. For five months after his badge was returned, the door was still open.

Security programs spend enormous energy on the front of the employment lifecycle — phishing simulations, onboarding training, awareness campaigns — and remarkably little on the end of it. Yet the departure is the one moment when access, motive, and inattention reliably line up. This guide covers what actually goes wrong when people leave, why the standard checklist misses most of the access, and how to build an exit process that closes every door the same day.

Most companies are haunted by former employees

The numbers on leftover access are consistently bad. Research from Wing Security in 2024 found that 63% of businesses may have former employees with access to organizational data, and that 43% may have ex-employees who can still reach code repositories on GitHub or GitLab. The same study counted the average employee using 29 different SaaS applications — every one of them a place where access can outlive the employment.

The view from the other side is no more comforting. In a Beyond Identity survey of former employees in the US, UK, and Ireland, 83% admitted to maintaining continued access to accounts from a previous employer — reading company email, logging into corporate social media, taking files. It is a vendor survey and the sample skews self-selected, so treat the precise figure as directional; but even heavily discounted, it describes a norm, not an exception.

And leftover access is expensive precisely because of who ends up using it. The 2026 Ponemon/DTEX Cost of Insider Risks Global Report puts the average annualized cost of insider incidents at $19.5 million per organization, with credential-driven incidents the most expensive single category at roughly $842,000 each — and an average containment time of 67 days. An account whose owner has left is the easiest credential of all to quietly abuse: the person it belongs to will never notice, report, or complain.

Every unfinished offboarding leaves your organization with a user who has credentials but no manager, no monitoring, and no reason to protect you.

Three ways a departure becomes an incident

The retaliating leaver. The Cisco case is the canonical example, and what makes it instructive is how ordinary the failure was: no exploit, no malware — just cloud credentials that still worked five months after resignation. Departing employees know where the valuable systems are, which controls are theater, and which shared passwords never change. When insider threat research talks about malicious insiders — 27% of incidents in the Ponemon/DTEX data — the period around departure is where they concentrate.

The curious ex-employee. Not every incident is sabotage. In 2022, Block disclosed that a former Cash App employee had downloaded internal reports containing data on 8.2 million customers — names, brokerage account numbers, portfolio values — months after leaving the company. The reports were part of his old job; the access simply hadn't been shut off. The result was regulatory disclosure, class-action litigation, and 8.2 million notification letters, all for want of a deprovisioning step.

The forgotten door. Sometimes the ex-employee is nowhere in the story — only their account is. The ransomware attack that shut down Colonial Pipeline in 2021 came through a legacy VPN profile that was not supposed to be in use, protected by a single password that investigators found reused elsewhere. A dormant account is an attacker's favorite kind of orphaned account: valid, privileged enough, and unwatched. Credential markets and infostealer logs are full of logins for accounts that organizations believe are closed.

Why the standard checklist misses

Almost every organization has an offboarding checklist. The gap is between the checklist and where access actually lives.

Access sprawled beyond the directory. Disabling the identity provider kills SSO — and touches nothing that was signed up with an email and password. Direct SaaS logins, OAuth grants to third-party apps, personal API keys, and tools adopted as shadow IT all survive. The 29-apps-per-employee figure is the size of this blind spot.

HR and IT run on different clocks. Termination is an HR event; deprovisioning is an IT ticket. Anything that flows through a queue has a latency, and for a hostile departure, hours matter. The organizations that get this right make the HR system the trigger: the termination record itself disables the identity, with no human in the loop.

Privilege accumulated silently. People collect entitlements with every project and role change and almost never lose them — privilege creep in action. By the time someone leaves after six years, nobody can enumerate what they can reach, so nobody can revoke it all. Enforcing least privilege during employment is what keeps the leaver checklist short; periodic access reviews are what keep it accurate.

The notice period is an exfiltration window. Insider research consistently shows data exfiltration clustering in the weeks around resignation — customer lists, source code, and pipeline documents synced to personal storage "for reference." If monitoring for bulk downloads only tightens after the exit interview, it tightens two weeks too late.

Contractors and vendors don't resign. Third parties often just stop showing up — no HR event fires, so no deprovisioning happens. Vendor accounts need owners, expiry dates, and the same same-day treatment employees get.

The same-day offboarding process

A defensible exit process is a timeline, not a form. NIST SP 800-53 control PS-4 states the requirement plainly: on termination, disable system access within an organization-defined time period, revoke credentials and authenticators, and retrieve organization property. In practice:

When	What to close	Examples
Before the announcement (sensitive exits)	Monitoring raised, high-risk access pre-staged for revocation	Bulk-download alerts, admin rights, production access
Hour zero	Identity, sessions, devices	IdP account disabled, active SSO sessions revoked, MFA tokens deregistered, remote wipe issued
Same day	Credentials the person knew	Shared and service-account passwords rotated, personal API keys revoked, break-glass credentials changed
Day one	The long tail outside SSO	Direct SaaS logins, OAuth grants, code repositories, shared mailboxes, marketing and social accounts
Week one	Physical and residual	Badges and hardware tokens collected, mail forwarding with expiry, final review of last-30-day activity
Quarterly	The doors you missed	User access reviews reconciling live accounts in every system against current staff

Three details separate programs that work from programs that audit well. First, deprovisioning must be automated from the HR record — same-hour, not same-ticket. Second, the process needs an owner for the long tail: someone accountable for the SaaS, keys, and grants that no directory knows about, which is where a SaaS inventory or SSPM tool earns its keep. Third, sudden and contentious departures get an accelerated version of all of it, because that is precisely the population the Cisco case comes from.

Departure risk is human risk

Offboarding is usually filed under IT operations, but everything above is a human problem: the access people accumulate, the files they sync in their final weeks, the passwords they share, the accounts nobody remembers. That makes it part of human risk management, not an adjacent chore — the leaver process is simply the lifecycle's final control, deserving the same rigor as the first-week onboarding at the other end.

It also benefits from the same instrumentation. A human risk score that weights access exposure alongside behavior tells you whose departure would hurt most before anyone hands in notice — the engineer with standing production access and a history of syncing files to personal drives is a different exit than the analyst with three SaaS logins. And the monitoring, escalation paths, and culture that a broader insider threat program builds are exactly what the notice-period window requires.

The Cisco engineer's access should have died the day he resigned. Five months of it cost $2.4 million and a service outage measured in weeks. Most organizations never get the dramatic version — they get the quiet one: the 63%, the orphaned accounts, the ex-employee still reading email. Same-day, automated, complete. Close the doors while you still remember where they are.