User offboarding gaps expose security and SaaS costs

At a glance

What this is: This is a case-study style analysis of user offboarding failures, showing how delayed access revocation and shadow SaaS create security, compliance, and cost exposure.

Why it matters: IAM, IGA, PAM, and SaaS governance teams need offboarding to be treated as a lifecycle control across users, applications, and subscriptions, because gaps persist long after departure.

By the numbers:

• A financial services client reduced ex-employee access from 23 days to under 24 hours in April 2025.
• A marketing agency eliminated over $1,800 per month in wasted SaaS subscriptions by February 2026.

Context

User offboarding is the process of removing access, subscriptions, and authority when someone leaves an organisation. In practice, it spans identity lifecycle management, SaaS governance, and compliance handoff, not just account disablement.

The control failure is usually not one dramatic mistake but delayed revocation across many systems. When access lingers after departure, organisations inherit avoidable security exposure, wasted SaaS spend, and audit gaps that are hard to defend later.

Key questions

Q: What breaks when employee offboarding depends on disconnected SaaS apps?

A: The first failure is that deprovisioning stops being automatic. If an app cannot accept identity or entitlement changes through a reliable control path, access removal falls back to manual work, which increases the chance of missed accounts, lingering admin rights, and audit findings after the employee leaves.

Q: Why do delayed offboarding processes create security risk?

A: Delayed offboarding creates security risk because access can remain active after the business relationship ends. Former users may still reach email, files, CRM, or admin tools, which expands the window for data theft or disruption. The issue is not the departure itself, but the period during which stale access still works.

Q: How do security teams know whether offboarding is actually working?

A: Security teams should measure completion, not process start. Confirm that accounts are disabled, tokens are revoked, privileged roles are removed, and recovery methods are no longer usable across every connected system. Sampling terminated identities is a practical way to prove whether revocation is real or only recorded.

Q: What is the difference between disabling a user account and fully off-boarding access?

A: Disabling a user account stops one login path, but full off-boarding also removes active sessions, cloud roles, application grants, shared credentials, and any NHI secrets tied to that person’s work. Organisations need the second model because a single account disable does not always stop access.

Technical breakdown

Why delayed offboarding creates persistent access risk

Offboarding risk starts when identity records, application entitlements, and SaaS subscriptions are managed as separate tasks. If a leaver’s account remains active in even one connected app, the organisation still has standing access exposure. In NHI terms, the same lifecycle problem appears with service accounts and tokens, but here the subject is a human identity that has not been fully deprovisioned. The operational failure is usually incomplete inventory, manual handoffs, or lack of cross-system revocation. That leaves a window where former staff can still reach sensitive data, even when the HR event is complete.

Practical implication: map the full revocation path from IdP to every downstream SaaS app before treating a departure as closed.

How shadow SaaS turns offboarding into a governance problem

Shadow SaaS creates a second offboarding problem because the organisation may not know every subscription or delegated connection tied to a departing user. That means the leaver can be removed from managed systems while hidden app access, billing, or OAuth grants remain active elsewhere. This is not just a cost issue. Untracked subscriptions also create unaudited data exposure and make access certification incomplete by design. The governance gap is visibility, not intent. If the asset is unknown, it cannot be revoked, reviewed, or evidenced for audit.

Practical implication: reconcile application inventory, subscriptions, and delegated access before and after each offboarding event.

Why offboarding timing matters more than the departure event itself

The article’s strongest operational signal is timing. A long delay between departure and revocation extends the period in which an ex-employee can still access data, use subscriptions, or retain a live path into business systems. In identity governance terms, the risk is not that offboarding exists, but that it is too slow to be trustworthy. When the process takes days or weeks, the organisation is relying on informal controls and manual follow-up rather than lifecycle enforcement. That weakens both security posture and compliance evidence.

Practical implication: define a measurable revocation SLA and treat every exception as a control failure requiring review.

Threat narrative

Attacker objective: Retain post-employment access to data and SaaS resources long enough to cause security exposure, compliance risk, or unnecessary cost.

1. Entry occurs through a departure event where the user should lose access but remains active across one or more systems.
2. Credential or account access persists because revocation is incomplete, delayed, or fragmented across SaaS tools and identity providers.
3. The attacker objective is to retain unauthorised access to data, subscriptions, or workflows long enough to create breach risk or wasteful spend.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Offboarding is a lifecycle control, not an administrative afterthought: The article shows that departure handling becomes a security and governance failure when access, subscriptions, and accountability are not removed together. Human identity offboarding only works when the revocation event is coordinated across the identity provider, downstream applications, and SaaS inventory. The practitioner lesson is to treat offboarding as a control boundary, not a ticket queue.

Shadow SaaS creates offboarding debt that most IAM programmes cannot see: If a departing user can still own hidden subscriptions or delegated access paths, then the organisation does not have a complete revocation model. That breaks the assumption that removing the primary account is enough. The implication is that SaaS discovery and offboarding must be governed as one lifecycle surface, not two separate processes.

Offboarding latency is the control weakness this case makes visible: An access window measured in days is not an operational detail, it is a standing exposure period. The article’s 23-day example shows how slowly managed departure events can leave organisations unable to evidence timely revocation. Practitioners should read that as a sign that lifecycle enforcement is still too manual to be trusted.

Cost leakage and security leakage are the same lifecycle failure seen from different angles: The wasted subscription example and the retained access example come from the same broken process. One produces direct financial waste, the other produces residual access risk, but both trace back to incomplete offboarding governance. Teams should not split these into separate programmes, because the control failure is shared.

From our research library:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
• Read next: NHI Lifecycle Management Guide

What this signals

Offboarding latency is an identity control problem, not an HR process problem: When revocation happens days after departure, the organisation is carrying avoidable access debt across both managed applications and shadow SaaS. That is the point where lifecycle governance becomes measurable risk rather than a policy statement.

Shadow SaaS is where offboarding programmes lose coverage: If the estate is not fully inventoried, the departure workflow will always miss something. That missing piece is usually either an orphaned account, an untracked subscription, or a delegated grant that still outlives the user.

For practitioners

• Map every offboarding dependency Build a complete exit workflow that includes the IdP, SaaS applications, delegated permissions, and subscription ownership before declaring a user fully offboarded.
• Set a revocation SLA Define a measurable time limit for access removal after departure and track exceptions until every downstream account and token is confirmed closed.
• Reconcile shadow SaaS before each departure Check for unmanaged subscriptions, orphaned accounts, and hidden OAuth grants tied to the user so offboarding does not stop at managed tools.
• Audit unused subscription spend Review dormant SaaS seats and recurring charges during offboarding to remove avoidable cost and reveal accounts that still need revocation.

Key takeaways

• Poor offboarding leaves organisations exposed to residual access, unmanaged subscriptions, and audit gaps after a user leaves.
• The article shows a concrete reduction from 23 days to under 24 hours for access removal, alongside more than $1,800 per month in subscription waste eliminated.
• The practical lesson is to govern offboarding as a lifecycle control across identity, SaaS inventory, and revocation timing.

Key terms

• Vendor offboarding: Vendor offboarding is the controlled removal of a third party's access, data paths, and operational dependencies when the relationship ends or changes. It is a lifecycle control, not an administrative closeout, because any surviving credentials or integrations remain active security exposure.
• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
• Access Revocation SLA: An access revocation SLA is the agreed time limit for removing privileges after a triggering event such as departure. It turns offboarding into a measurable control, which is essential when security and compliance depend on proving that access did not linger.
• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.

Deepen your knowledge

NHI governance, identity lifecycle management, and SaaS access control are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.