Topic starter
11/11/2026 6:01 pm
TL;DR: After departure, forgotten accounts and stale permissions can remain active, according to MetaCompliance, so legitimate access can outlive the employee. That creates an avoidable route into systems, shared drives and business applications that looks routine until it is abused.
Editorial analysis by NHI Mgmt Group, based on content published by MetaCompliance: “Insider Threats: Why Your Offboarding Process Is The Weakest Link in your Cyber Security”.
Key questions
Q: Why do former employees still pose access risk after leaving?
A: Former employees can still pose access risk because their service accounts, VPN accounts, API tokens, cached sessions, and shared credentials may remain active after payroll ends or device return.
Q: How does access sprawl increase leaver risk?
A: Access sprawl increases leaver risk by multiplying the number of accounts, entitlements, secrets, and systems that must be removed when someone leaves.
Q: How do I offboard user accounts without leaving access behind?
A: Start by tying offboarding to a single authoritative exit trigger, then remove account access, app entitlements, delegated rights and shared resources in the same workflow.
Practitioner guidance
- Tighten exit-triggered revocation Require HR, IT and security to trigger account disablement and entitlement removal from the same event, with no manual handoff delay.
- Inventory every system that grants access Maintain a current list of SaaS, collaboration, finance and project tools so leaver revocation reaches every place where access can survive.
- Separate account closure from permission removal Verify that disabling a directory account also removes delegated access, shared mailbox rights, group memberships and app-specific privileges.
Bottom line: The core problem is residual access, where accounts or permissions survive departure and remain usable after the employee has left.
Glossary terms: Insider Threat, Off-boarding, Account Management, Leaver workflow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Offboarding is a control boundary, not an admin chore: MetaCompliance's framing is useful because it treats departure as the moment when access must be decisively closed. The governance issue is not whether an employee leaves cleanly, but whether every privilege tied to that identity is removed before it becomes reusable. Practitioner takeaway: if revocation is not owned as a security control, offboarding will always lag the risk.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do first when offboarding a contractor?
A: First, revoke all active access and find every identity the contractor used: IAM accounts, service accounts, API keys, tokens, certificates and shared secrets. Then transfer ownership of data, repos and cloud resources, rotate any exposed credentials, and confirm removal from groups, VPNs and privileged roles before closing the offboarding record.
👉 Read our full editorial: Weak offboarding leaves dormant access open to insider risk