What happens when offboarding is slow during layoffs or resignations?

When offboarding is slow, departing workers have more time to exfiltrate data, tamper with files, or abuse still-active accounts. The article cites a sharp surge in exfiltration activity before layoffs, which shows that timing matters. Slow revocation also increases the chance of downstream legal, operational, and reputational damage once confidential information leaves authorised environments.

Why Slow Offboarding Becomes a Security Problem During Workforce Change

Slow offboarding turns a routine HR event into an access-control exposure because the organisation is still trusting a person who is already leaving. During layoffs or resignations, that delay can preserve access to email, file stores, SaaS applications, cloud consoles, and shared credentials long enough for information to move outside authorised channels. It also weakens evidence trails, because actions taken after notice may be harder to distinguish from normal work if revocation is delayed. For a practical control view, see NIST SP 800-53 Rev 5 Security and Privacy Controls.

Practitioners often underestimate how much damage can happen in the gap between notice and deprovisioning, especially when access is spread across many systems and no one owns the full shutdown sequence.

How Slow Revocation Changes the Risk Window

The security issue is not only that access remains active, but that the organisation loses control over intent and timing. A departing employee may still have legitimate reasons to work for part of a notice period, yet that same access can be used to copy data, alter records, or create quiet persistence in systems that are not checked immediately. The longer the delay, the more likely it is that access tokens, sessions, VPN paths, and delegated permissions remain usable after the business relationship has effectively changed.

In practice, offboarding needs to be treated as a sequence rather than a single ticket. The most important steps are usually account disablement, session termination, credential rotation where the person knew secrets, transfer of ownership for shared resources, and review of high-risk access such as admin panels, source control, finance systems, and customer data stores. When those steps happen out of order, organisations often create a short window that is operationally convenient but security poor.

A simple way to think about it is this: if the person can still authenticate, the organisation has not really finished offboarding. The same is true for API keys, service credentials, or jointly used admin accounts that outlive the individual. The control challenge is not just removing logins, but closing every path that still lets the departing user reach sensitive data or privileged actions.

This guidance breaks down when access is decentralised, shadow accounts exist, or the organisation cannot identify all systems where the person had a role.

Where the Usual Playbook Fails: Exceptions, Timing, and Shared Access

Tighter offboarding often increases operational friction, requiring organisations to balance rapid containment against business continuity for handover tasks and final payroll, legal, or support obligations. The trade-off becomes sharper during mass layoffs, where many terminations happen at once and teams may be tempted to batch revocation instead of cutting access immediately.

There are also important edge cases. Executive exits, sensitive investigations, and involuntary terminations usually justify faster containment than ordinary resignations, because the risk of misuse can be higher and more immediate. By contrast, some planned resignations need limited temporary access for handover, but that should be explicit, time-boxed, and narrower than the person’s normal access. Shared accounts, undocumented integrations, and long-lived tokens are especially problematic because they can survive even when the human account is removed.

Industry guidance is not always consistent on the exact sequence for every environment, but there is broad agreement that access removal must be faster than the business process would naturally be if the data involved is sensitive. The common failure is assuming HR notice alone is enough. It is not. Security teams need a separate trigger, a separate checklist, and a clear exception path for access that cannot be removed immediately without creating a larger operational problem.

Risk and Threat Considerations

Slow offboarding creates a material insider-risk window. The main exposure is not only malicious theft, but also careless post-notice behaviour, disputed actions, and continued use of trusted access after the employment relationship has changed. That can affect confidentiality, integrity, and the organisation’s ability to prove who did what.

Failure mechanism: The risk materialises when authentication, session, or delegation paths remain active after notice, allowing the departing worker to use legitimate access for exfiltration, tampering, privilege abuse, or covert persistence. The longer the delay, the more opportunity exists to move data out through channels that still appear authorised.

Impact: Sensitive information can leave controlled environments, business records can be altered, and incident response becomes harder because post-notice activity may blend with ordinary work. The organisation may also face legal and contractual consequences if confidential or regulated data is exposed.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AC-1 — Identity and Credential Management	Slow offboarding delays removal of user access and credentials.
	PR.AC-4 — Access Permissions and Authorizations	Departing workers may retain excessive permissions during the exit window.
Recommendation — Revoke departing users’ access and credentials immediately across all systems. Tighten authorizations during offboarding to remove unnecessary access paths.
CIS Controls v8	5.3 — Disable Dormant Accounts	Offboarding delay leaves accounts active after the business need ends.
	6.3 — Access Rights Removal	Access rights must be removed when a user leaves or changes role.
Recommendation — Disable or remove accounts as soon as employment ends or changes. Remove departing users’ access rights from systems, groups, and applications.
MITRE ATT&CK	T1078 — Valid Accounts	Active departing-user accounts can be abused for continued authorised access.
	T1027 — Obfuscated Files or Information	Departing insiders may hide exfiltration or tampering activity during the window.
Recommendation — Monitor for continued use of valid accounts after offboarding starts. Inspect suspicious post-notice activity for concealed staging or transfer patterns.

Practitioner Guidance

What to prioritise: Treat notice of departure as a security event when the person had access to sensitive data, admin functions, finance systems, customer records, source code, or cloud infrastructure. Those paths should be reviewed first because they create the fastest route from continued access to material harm.

Decision rule: If the person can still authenticate, inherit permissions through a group, or use a shared secret, deprovisioning is not complete. If immediate removal would break a critical process, narrow access instead of leaving full access in place, and document the exception with an expiry time.

What to verify: Confirm that account disablement, session invalidation, credential rotation, and ownership transfer all happened for the systems the person actually used, not just the HR system or directory. The most common miss is assuming one identity action removed all downstream access when it did not.

Practitioner takeaway: The real control objective is to end trust quickly without losing business continuity, and the organisations that struggle most are usually the ones that know who left before they know everywhere that person could still log in.