Topic starter
12/06/2026 1:22 am
TL;DR: Patchy IT offboarding leaves former employee access, shared credentials, and remote login paths active long enough to create breach, compliance, and license waste risks, according to Zluri. Offboarding is still being treated as an admin task instead of a lifecycle control point, while TechRepublic says 70% of IT decision-makers need up to an hour to deprovision a single leaver’s accounts.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Secure IT Offboarding Checklist - 7-point step for IT and Security teams”.
By the numbers:
- 20% of businesses have experienced data breaches connected to former employees.
- 70% of IT decision-makers surveyed said it could take up to an hour to deprovision all of a single former employee’s corporate application accounts.
- 50% of former employee accounts remain active for longer than one day after departure.
Key questions
Q: What breaks when a former employee account is not fully revoked?
A: A retained former employee account can preserve the exact permissions an attacker needs to alter, delete, or exfiltrate cloud and SaaS assets.
Q: When should organisations prioritise ownership transfer over access revocation?
A: Ownership transfer should happen before or alongside access revocation when the departing user owns documents, subscriptions or application admin rights.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Define offboarding as a multi-control workflow Map the leaver process across ownership transfer, application access, SSO removal, remote access revocation, shared credential rotation and asset recovery before you automate it.
- Remove application access before SSO disablement Use application-level revocation first so that disabling the identity provider does not strand admin rights, sessions or ownership inside downstream systems.
- Reset shared credentials at departure Rotate passwords, tokens and session secrets for any shared account the departing user could access, especially collaboration and productivity tools.
Bottom line: Incomplete offboarding leaves a former employee identity footprint active across applications, remote channels and shared secrets.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 11:15 am
Leaver offboarding is a lifecycle control, not an admin cleanup task: The article shows that access removal, ownership transfer and asset recovery are interdependent governance steps. If organisations treat them as separate tickets, they create a residual-access window that outlives the employment relationship. The practical conclusion is that joiner-mover-leaver governance must be sequenced, verified and owned as a single control domain.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between SSO disablement and full offboarding?
A: SSO disablement cuts off one authentication path, while full offboarding removes access from downstream applications, remote methods, shared accounts and ownership structures. They are not equivalent. A user can be blocked from the directory and still retain live sessions, cached access or control over assets elsewhere.
👉 Read our full editorial: IT offboarding gaps leave former employee access alive
This post was modified 4 days ago by NHI Mgmt Group