User offboarding gaps expose security and SaaS costs

At a glance

What this is: This is a case-study style analysis of user offboarding that shows how delayed access removal and unmanaged SaaS subscriptions create security, compliance, and cost exposure.

Why it matters: It matters because offboarding failures affect human IAM, NHI governance patterns, and lifecycle control discipline, especially where access spans many apps and accounts.

By the numbers:

• A financial services client reduced ex-employee access from 23 days to under 24 hours in April 2025.
• A marketing agency eliminated over $1,800 per month in wasted SaaS subscriptions by February 2026.
• Manually removing access across 100% of applications remains impractical when many organisations rely on dozens of SaaS tools.

👉 Read Unixi's analysis of user offboarding, security risk, and SaaS management

Context

User offboarding is the process of removing a departing person's access to systems, data, and subscriptions. In practice, it is an identity lifecycle problem, not just an HR handoff, because delays leave active accounts, residual data access, and orphaned SaaS subscriptions behind. For IAM teams, the risk is not only breach exposure but also incomplete accountability across the full access chain.

The article uses user offboarding to show a common governance failure: access is often removed slowly, inconsistently, or only from the most visible systems. That creates security, compliance, and productivity problems at the same time. The same lifecycle discipline that applies to service accounts and other NHIs also applies here, because the core issue is whether access is fully revoked everywhere it exists.

Key questions

Q: What breaks when employee offboarding is treated as an HR task instead of an identity control?

A: Access often persists in applications, shared resources, and delegated workflows after the person leaves. HR can trigger the departure, but IT and security still need evidence that every entitlement was revoked. Without that control, former-user access becomes a lifecycle failure that can lead to misuse, audit findings, and data exposure.

Q: Why do departed users still retain access in SaaS-heavy environments?

A: Because access is often spread across many applications, local roles, and unmanaged subscriptions. If the organisation does not maintain a complete inventory, revocation will miss some systems. The more fragmented the SaaS estate, the more likely access persists after employment ends.

Q: How do security teams know whether offboarding is actually working?

A: Security teams should measure completion, not process start. Confirm that accounts are disabled, tokens are revoked, privileged roles are removed, and recovery methods are no longer usable across every connected system. Sampling terminated identities is a practical way to prove whether revocation is real or only recorded.

Q: Who is accountable when former employees still retain access?

A: Accountability usually sits across HR, IT, and the application owner, but the security team owns the control design. If access survives departure, the programme failed to assign clear revocation ownership, confirm closure, or enforce cross-system checks. Identity governance should define one accountable owner for leaver state closure.

Technical breakdown

Why offboarding fails across SaaS environments

Modern offboarding breaks because access is distributed across identity providers, direct logins, shadow SaaS, and app-specific permissions. A single disable action rarely reaches every linked service, token, or subscription. That leaves residual entitlements behind even when the primary account is closed. The problem is not only technical sprawl, but also the assumption that one system can represent the whole access state. In reality, SaaS estates create multiple identity surfaces that must each be governed.

Practical implication: teams need a complete application inventory and revocation path for every system where employee access may persist.

The lifecycle gap between departure and revocation

Offboarding risk grows in the time window between notice, departure, and final revocation. During that window, former users may still access email, file stores, admin consoles, or shared apps. This is an identity lifecycle failure because entitlement removal is delayed relative to employment change. The longer the delay, the more likely the organisation is to face data exposure, audit exceptions, or recovery work. The key technical issue is not simply access removal, but timely revocation across all authoritative and downstream systems.

Practical implication: reduce the time between termination trigger and full entitlement revocation to the smallest operational window possible.

Shadow SaaS and orphaned subscriptions

Shadow SaaS refers to subscriptions and applications that are not centrally tracked but still contain employee credentials or payment obligations. These tools often bypass standard offboarding because they were never fully onboarded into IAM governance. The result is twofold: hidden cost from unused subscriptions and security exposure from accounts that remain active after departure. In lifecycle terms, the organisation has lost sight of the identity surface it is supposed to govern.

Practical implication: include shadow SaaS discovery in offboarding controls so hidden apps are not left outside revocation and review.

Threat narrative

Attacker objective: The objective is to preserve unauthorized access long enough to extract data, misuse accounts, or maintain hidden access after departure.

1. Entry begins when a departing employee still has valid access to internal systems, SaaS applications, or shared credentials after notice or termination.
2. Escalation occurs when that standing access remains active long enough for data access, administrative actions, or subscription abuse to continue unchecked.
3. Impact follows as sensitive information remains exposed, audit risk increases, and the organisation continues paying for unused or orphaned SaaS accounts.

Breaches seen in the wild

• Coupang Signing Key Breach — Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Offboarding is lifecycle governance, not an HR admin task. The article correctly shows that departure handling affects security, compliance, and cost at the same time. In IAM terms, the central question is whether access is revoked everywhere it exists, not whether one account is disabled in one directory. Teams that treat offboarding as a workflow step miss the larger control problem, which is incomplete entitlement retirement.

Shadow SaaS creates an identity blind spot that standard offboarding misses. When applications are not inventoried, they are not governable at departure time. This is the same structural problem seen in unmanaged NHIs: if the identity surface is not known, it cannot be offboarded, certified, or audited. Practitioners should read this as an argument for full application visibility before attempting lifecycle automation.

Access duration is the real control variable. Reducing ex-employee access from days to hours changes breach exposure, compliance posture, and recovery effort. The exact timeline matters less than the principle that revocation must happen fast enough to make residual access operationally irrelevant. For IAM and PAM teams, the measure of success is not process completion, but the shrinking of the standing-access window.

Named concept: offboarding lag debt. This article exposes the cost of letting entitlement removal drift away from the departure event. That lag accumulates in security exposure, SaaS waste, and audit exceptions. The implication for identity governance is that lifecycle controls must be designed around revocation latency, not just completion rate.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
• Only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• For a broader view of lifecycle control, see NHI Lifecycle Management Guide and Ultimate Guide to NHIs - Lifecycle Processes for Managing NHIs.

What this signals

Offboarding lag debt: When access revocation trails the departure event, the organisation accumulates hidden exposure across SaaS, admin roles, and shared accounts. The practical signal is simple: if termination-to-revocation is measured in days, the identity programme is absorbing avoidable risk instead of collapsing it.

With 68% of organisations saying they do not know how to fully address NHI risks, lifecycle controls are still being built faster than governance can keep up, according to the Ultimate Guide to NHIs. That same gap shows up in human offboarding when hidden apps and residual access are not fully mapped.

Practitioners should align offboarding, access review, and SaaS discovery into one control loop, then use NHI Lifecycle Management Guide as a model for visibility-driven revocation rather than relying on a single disable action.

For practitioners

• Map every departure path to every access surface Build an inventory that includes IdP-linked apps, direct SaaS logins, shared admin consoles, and shadow SaaS subscriptions so revocation cannot stop at the first system. Use the NHI Lifecycle Management Guide as a model for full lifecycle visibility.
• Shorten the revocation window to hours, not days Set an operational target for termination-to-revocation that is measured in hours and enforce it through automation where possible. The goal is to eliminate the period where a departed user still has active access across business systems.
• Include SaaS subscription cleanup in offboarding Tie account disablement to subscription review so unused licenses, hidden admin roles, and orphaned billing accounts are removed together. This reduces both security exposure and recurring cost.
• Require offboarding evidence for audit and assurance Record which systems were checked, which accounts were revoked, and when each action completed. That evidence supports compliance reviews and makes delays visible to security, HR, and audit teams.

Key takeaways

• Poor offboarding leaves access, subscriptions, and audit exposure active long after a person has left.
• The article’s examples show that shrinking revocation time from days to hours materially reduces both security risk and SaaS waste.
• Identity teams should treat departure handling as lifecycle governance across every application, not as a narrow HR workflow.

Key terms

• Vendor offboarding: Vendor offboarding is the controlled removal of a third party's access, data paths, and operational dependencies when the relationship ends or changes. It is a lifecycle control, not an administrative closeout, because any surviving credentials or integrations remain active security exposure.
• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
• Revocation Latency: Revocation latency is the time between a decision to remove access and the point at which that access is actually gone. It is a practical measure of how long stale privilege remains usable after a role change, offboarding, or contract end. Shorter latency means smaller exposure and cleaner audit evidence.

What's in the full article

Unixi's full article covers the operational detail this post intentionally leaves for the source:

• How the one-click offboarding flow is structured across managed and unmanaged applications
• The specific SaaS management issues behind Shadow SaaS cleanup and subscription waste
• The operational sequence used to cut ex-employee access from days to under 24 hours
• The customer examples behind the reported security and cost outcomes

👉 Unixi's full article covers the client examples, access reduction timeline, and SaaS cleanup detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.