What happens when an employee leaves but keeps access to company systems?

When an ex-employee keeps access, the organisation inherits a live insider threat. That person may retain the ability to reach sensitive systems, download data, or disrupt operations after departure. The article stresses that physical items, digital keys, certificates, and credentials should be removed together, because any leftover access path can become the easiest route to a breach.

Why Leftover Access Becomes an Insider Risk

When someone leaves and their access is not removed, the organisation is no longer dealing with a normal ex-employee record. It is dealing with a still-authenticated actor who may retain the ability to open systems, read data, trigger workflows, or reach privileged functions long after HR considers the relationship closed.

The practical danger is that this access often outlives the departure process itself. Physical badges, VPN profiles, SSO sessions, API keys, certificates, and application credentials can each remain valid on different timelines, which means one missed revocation can preserve a usable path even when other controls are closed.

That is why offboarding must be treated as a coordinated access-removal event, not a simple account closure. A person can leave the company but still carry enough trust to act like an internal user until every surviving credential, token, key, and device trust path is removed or expired.

Revoke access in the identity source and in downstream systems, not only in the primary directory.
Invalidate sessions, tokens, and certificates so old authentication material cannot remain useful.
Confirm that physical access, remote access, and application-level access all fail after departure.

If you want the broader lifecycle and governance context, NHIMG’s Ultimate Guide to NHIs covers lifecycle, rotation, and offboarding patterns that also explain why residual access is so persistent.

What Can Go Wrong After Offboarding Fails

Residual access can produce several different failure modes. The mildest is routine misuse, where a former employee still sees data they should no longer reach. The more serious cases involve deliberate exfiltration, sabotage, or quiet persistence, especially when the account retains access to production systems, administrative consoles, or shared secrets.

Risk increases when old access is broad, poorly inventoried, or linked to automation. A forgotten login may be harmless on paper, but if it can reach file stores, cloud consoles, source code, or administrative tooling, it can become the easiest path to data loss or operational disruption.

The issue is also cumulative. The longer dormant access stays alive, the more likely it is to survive password changes, team reshuffles, and system migrations. That is why organisations that only review “active users” often underestimate how much usable access remains outside the obvious employee lifecycle.

NHIMG’s Key Challenges and Risks is a useful reference point for the underlying patterns of privilege, visibility, and credential sprawl that make leftover access hard to eliminate.

One data point from the NHIMG research block captures the operational gap clearly: only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them. That matters because a departed employee’s access often includes machine-facing credentials, not just a password.

Risk and Threat Considerations

Residual access is a classic compromise path because it preserves legitimate trust after the relationship has ended. An ex-employee with live credentials can behave like an insider, but without the oversight, attribution, or business need that originally justified the access.

Failure mechanism: Offboarding is incomplete, so one or more access paths remain valid, such as stale sessions, unmanaged keys, inherited permissions, or certificates that were never revoked. Attackers, disgruntled former staff, or simple account reuse can then exploit the surviving trust path to access systems without triggering obvious login failures.

Impact: Sensitive data exposure, unauthorised changes, service disruption, and delayed breach detection are all plausible outcomes. In higher-privilege environments, the same weakness can also support lateral movement, persistence, or destruction of records after departure.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Management	Residual access usually survives through unrevoked keys, tokens, and certificates.
	NHI-02 — Identity Lifecycle and Offboarding	The question is fundamentally about failing to deprovision access at employee exit.
	NHI-04 — Least Privilege and Access Governance	Leftover access becomes dangerous when permissions are broader than the person still needs.
Recommendation — Rotate and revoke all credentials tied to departed users and service access paths. Enforce offboarding workflows that remove accounts, sessions, and delegated access in sequence. Reduce standing access so former staff cannot retain unnecessary reach into production systems.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	Employee departure is an access-control event that must terminate authentication and authorisation paths.
	PR.PS — Personnel Security	Offboarding is a personnel-security control that limits insider and post-employment exposure.
Recommendation — Revoke user access promptly and verify that authentication can no longer succeed after departure. Tie HR departure events to mandatory access removal and ownership confirmation.
CIS Controls v8	5 — Account Management	CIS Control 5 directly addresses removal of dormant or departed-user accounts and access.
	6 — Access Control Management	Access control management covers permissions, sessions, and residual authorisation after exit.
Recommendation — Disable and remove accounts immediately when employment ends, then review for orphaned access. Validate that every remaining access path is denied after offboarding.
NIST SP 800-63	AAL — Authentication Assurance Level	Session and authenticator strength affect how long a departed user's credentials remain usable.
Recommendation — Use stronger authenticators and session limits so stolen or stale access expires quickly.
NIST Zero Trust (SP 800-207)	SC-7 — Policy Enforcement Point and Continuous Verification	Zero Trust requires access decisions to be continuously re-evaluated, including after employment changes.
Recommendation — Continuously re-evaluate access so terminated users cannot rely on previously trusted paths.

Practitioner Guidance

What to verify: Treat departure as verified only when the organisation can prove that every relevant access path is closed, including directory accounts, SSO sessions, VPN access, application roles, API keys, certificates, and any shared or delegated credentials. If any one of those remains live, the offboarding action is not complete.

Decision rule: If the departing worker ever had access to production, finance, customer data, or admin tooling, prioritise immediate revocation and post-departure review over convenience-based delay. If the access was limited and fully time-bounded, the residual risk is lower, but it still requires confirmation rather than assumption.

Practitioner takeaway: The real control objective is not merely removing a username, it is ensuring that no surviving credential or trust relationship can still act on the organisation’s behalf after employment ends.