Topic starter
06/06/2026 1:49 am
TL;DR: Marketing tools keep former agencies and contractors active long after relationships end, and Ponemon Institute data cited by Cerby shows 68% of organisations cannot reliably remove employee access on departure, 77% have had incidents tied to disconnected apps, and 63% have failed audits because of securing gaps. The core problem is not intent but lifecycle control: access removal for external collaborators is treated as optional, so entitlement drift becomes normalised.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “I Hired an Agency. I Have No Idea If They Still Have Access to Our Accounts.”.
By the numbers:
- 68% of organisations can't reliably remove access when an employee leaves.
- 77% of organisations experienced at least one cybersecurity incident tied to disconnected apps in the past two years.
- 63% of organisations have failed an audit at least once because of gaps in securing these apps.
Key questions
Q: What breaks when agency access is not formally offboarded?
A: Former agencies and contractors can remain active in marketing tools long after the business relationship ends.
Q: Why do disconnected apps create so much access risk?
A: Disconnected apps create risk because they sit outside the enterprise identity fabric, so access is granted and removed locally instead of through central controls.
Q: How should teams review agency access in marketing platforms?
A: They should review access against current contracts, current campaigns, and current business ownership, not against historical convenience.
Practitioner guidance
- Audit marketing tools for stale external access Review Meta Ads Manager, LinkedIn Business Manager, HubSpot, CMS platforms, and similar tools for agency and contractor accounts that no longer map to an active engagement.
- Tie removals to contract end dates Make access removal a required offboarding step when the SOW expires, the campaign ends, or the vendor relationship changes, even if the relationship feels temporary or informal.
- Assign named owners for every shared marketing app Give each business tool a responsible owner who can answer who has access, why they have it, and whether that access still matches current work.
Bottom line: Former agencies and contractors often remain active in marketing tools because no one owns the offboarding event when the work ends.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:09 am
Agency access sprawl is an offboarding failure, not an access-granting problem. The issue begins when external collaborators are added quickly for campaign delivery and then never formally removed when the work ends. That makes the control gap lifecycle governance, not user provisioning. The practitioner conclusion is that marketing access must be governed as a finite entitlement with a defined end state.
A question worth separating out:
Q: What should organisations do when a marketing tool cannot integrate with SSO or SCIM?
A: They need a documented manual revocation process with a named owner, a removal checklist, and periodic verification that the process still works. If the tool cannot be reached by enterprise identity controls, governance has to shift to operational discipline rather than assumption.
👉 Read our full editorial: Marketing agency access sprawl is an offboarding failure, not a one-off