Marketing agency access sprawl is an offboarding failure, not a one-off

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cerby's blog post: Former contractors and vendors often remain active in marketing tools because offboarding is not consistently owned or executed.

Why it matters: It matters because marketing stacks frequently sit outside central IAM and IGA visibility, leaving external access unmanaged even when the business relationship has ended.

By the numbers:

• 68% of organisations can't reliably remove access when an employee leaves.
• 77% of organisations experienced at least one cybersecurity incident tied to disconnected apps in the past two years.
• 63% of organisations have failed an audit at least once because of gaps in securing these apps.

Context

Marketing access sprawl is a governance problem, not a one-off mistake. When agencies, freelancers, and contractors keep access after the work ends, the issue is not intent but the absence of a reliable offboarding trigger for external collaborators.

In many marketing environments, the identity stack does not fully cover ad platforms, CMS tools, and automation systems. That leaves ownership fragmented between marketing and IT, with no consistent lifecycle control over who should still have access.

The article frames this as a common operating condition rather than an edge case. Once access is granted for a campaign, the relationship can fade without a formal ending, which is why stale access becomes normalised.

Key questions

Q: What breaks when agency access is not formally offboarded?

A: Former agencies and contractors can remain active in marketing tools long after the business relationship ends. That leaves live access paths open to people who no longer need them, and it creates a control gap when no one can prove the account was intentionally removed.

Q: Why do disconnected apps create so much access risk?

A: Disconnected apps create risk because they sit outside the enterprise identity fabric, so access is granted and removed locally instead of through central controls. That makes it easy for former vendors, contractors, or employees to remain active long after the business need ends. The risk is highest when no one can prove who currently has access.

Q: How should teams review agency access in marketing platforms?

A: They should review access against current contracts, current campaigns, and current business ownership, not against historical convenience. If the person or agency cannot be tied to active work, the default should be removal until the entitlement is re-approved.

Q: What should organisations do when a marketing tool cannot integrate with SSO or SCIM?

A: They need a documented manual revocation process with a named owner, a removal checklist, and periodic verification that the process still works. If the tool cannot be reached by enterprise identity controls, governance has to shift to operational discipline rather than assumption.

Technical breakdown

Why marketing tool access becomes sticky after the work ends

Marketing tools often rely on local user lists instead of enterprise identity controls. That means access is provisioned directly inside the application, but removal depends on someone remembering the specific account, the tool, and the right admin path. When agencies or contractors are brought in for campaigns, the entitlement is often tied to the project rather than to a lifecycle event. Without a formal offboarding trigger, the user entry remains active long after the business need has expired. This is a classic lifecycle failure, not a technical mystery.

Practical implication: map marketing applications to a documented offboarding owner and remove manual dependency from account closure.

Why disconnected apps defeat central IAM visibility

Disconnected apps are systems that sit outside the normal identity stack, so central provisioning and deprovisioning workflows never reach them cleanly. In practice, that means a user may be removed in one system while remaining active in an ad platform, CRM, or social management console. The resulting control gap is visibility, not just authentication. If IT cannot see the application or the user list, it cannot attest to access state, certify entitlements, or prove revocation. The control plane is fragmented, so governance becomes partial by design.

Practical implication: inventory marketing tools by identity control coverage and close gaps where SSO or SCIM is absent.

What happens when agency relationships outlive accountability

Agency access is especially risky because the relationship is socially ambiguous. There is often no clean last day, and the person who granted access may leave before the access is reviewed. That creates a handoff problem where accountability evaporates faster than entitlement does. If an agency later changes staff, suffers a breach, or ends the relationship badly, the former access can still expose live business data and controls. The underlying weakness is not the agency itself, but access that remains valid after the governance relationship has ended.

Practical implication: tie third-party access reviews to contract end dates, not to informal relationship memory.

Threat narrative

Attacker objective: The objective is to preserve unauthorized access to marketing systems long enough to observe, modify, or abuse business operations and data.

1. Entry occurs when agencies, freelancers, or contractors are granted direct access to marketing tools for campaign work and that access is never formally removed.
2. Standing access persists because the account owner, the business owner, and the IT team each assume someone else will close it.
3. Impact comes when a former collaborator, a departed agency employee, or a compromised vendor account can still reach ad accounts, CMS tools, or customer data.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agency access sprawl is an offboarding failure, not an access-granting problem. The issue begins when external collaborators are added quickly for campaign delivery and then never formally removed when the work ends. That makes the control gap lifecycle governance, not user provisioning. The practitioner conclusion is that marketing access must be governed as a finite entitlement with a defined end state.

Disconnected marketing apps create a blind spot that central IAM does not automatically solve. If the application is outside the identity plane, revocation, review, and attestation become application-by-application tasks rather than enterprise controls. That is why the problem persists even in organisations with mature IAM on paper. The practitioner conclusion is that tool coverage matters as much as policy language.

Vendor and agency access should be treated as third-party NHI lifecycle, not informal business convenience. External users often behave like persistent delegated identities with broad access and weak oversight. When the relationship changes, the entitlement should change with it, but most marketing teams never operationalise that handoff. The practitioner conclusion is that third-party access offboarding belongs in the same governance model as employee leavers.

Access review cadence is the wrong control if no one owns the last day. Recertification assumes there is a stable inventory to certify, but marketing teams often inherit users they cannot identify or justify. In that environment, review becomes retrospective theatre unless it is paired with explicit contract-based offboarding. The practitioner conclusion is that certification must be anchored to business change events, not calendar reminders.

What this signals

Lifecycle control is the real gap: access to marketing systems often persists because the organisation never defines the end of a third-party relationship in identity terms. The result is not just leftover accounts, but a governance model that treats external collaboration as temporary in theory and permanent in practice.

Marketing stacks expose a broader pattern that IAM leaders already see elsewhere: if an application is purchased and run outside the core identity plane, deprovisioning becomes dependent on human memory. That is why external access problems reappear even in companies with strong enterprise IAM elsewhere.

Third-party access offboarding should be measured as a business event, not an IT ticket: when contracts, campaigns, and agency relationships change, access should change with them. The more the organisation relies on informal handoffs, the more likely stale access will survive the next campaign or reorg.

For practitioners

• Audit marketing tools for stale external access Review Meta Ads Manager, LinkedIn Business Manager, HubSpot, CMS platforms, and similar tools for agency and contractor accounts that no longer map to an active engagement.
• Tie removals to contract end dates Make access removal a required offboarding step when the SOW expires, the campaign ends, or the vendor relationship changes, even if the relationship feels temporary or informal.
• Assign named owners for every shared marketing app Give each business tool a responsible owner who can answer who has access, why they have it, and whether that access still matches current work.
• Standardise manual revocation paths where SSO is missing Document the exact removal process for apps that do not support central identity controls so that deprovisioning does not depend on memory or tribal knowledge.
• Review third-party access after staff turnover Re-check inherited user lists whenever the marketing owner changes, because stale vendor accounts often survive personnel shifts inside the business.

Key takeaways

• Former agencies and contractors often remain active in marketing tools because no one owns the offboarding event when the work ends.
• The article ties the problem to a broader governance failure, with Ponemon data cited by Cerby showing widespread revocation, disconnected-app, and audit issues.
• The practical fix is to bind access removal to contract lifecycle, inventory the tools IT cannot centrally reach, and assign clear ownership for every shared marketing application.

Key terms

• Disconnected App: A disconnected app is a business system that does not participate in the enterprise identity fabric and is managed outside central IAM workflows. Access is often granted locally, reviewed manually, and forgotten easily. These apps create governance blind spots because ownership, revocation, and evidence are fragmented across teams.
• Third-Party Offboarding: The process of revoking and validating access when a vendor, distributor, or contractor relationship ends or changes. Effective offboarding is not just account deletion, but confirmation that access paths, integrations, and inherited permissions have all been removed.
• Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
• Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.