Notifications
Clear all
Topic starter
25/06/2026 5:09 pm
TL;DR: Manual offboarding remains a common cause of orphaned accounts, stale access and audit failure because identity, SaaS, session, VPN and physical controls are often revoked in separate steps, according to Clarity Security. The governance problem is not speed alone, but whether leaver processes actually close every access path before accountability disappears.
NHIMG editorial — based on content published by Clarity Security: an IT offboarding checklist for modern security and IT teams
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams implement offboarding so former employees lose access everywhere?
A: Start with a single leaver workflow that disables the identity at the source, then fan out to SaaS, VPN, cloud storage, device management and physical access systems.
Q: Why do orphaned accounts keep appearing after employee terminations?
A: Orphaned accounts persist when offboarding only covers the primary directory and ignores downstream systems that authenticate independently.
Q: How do you know if an offboarding process is actually working?
A: Measure how many identities still have active access after termination, how long revocation takes, and how often unmanaged systems are discovered in post-termination reviews.
Practitioner guidance
- Reconcile every leaver workflow to one revocation sequence Build a termination runbook that lists the IdP, SSO, SaaS apps, VPN, cloud storage, shared credentials, devices and physical badges that must be disabled in order.
- Separate access removal from asset transfer Transfer file ownership, inbox custody and application ownership before deletion, but do not delay access revocation while waiting for the business to preserve content.
- Log the evidence needed for audit and remediation Capture who approved the leaver action, what systems were touched, what remained open, and when each step completed.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step leaver checklist template you can adapt for HR-triggered terminations and emergency offboarding.
- Specific handling for SaaS accounts, shared credentials, device retrieval and physical badge deactivation.
- Practical guidance on evidence logging, delayed deletion and post-termination account monitoring.
- The vendor's automation workflow examples for tying HR events to deprovisioning tasks and review steps.
👉 Read Clarity Security's IT offboarding checklist for leaver workflow control →
IT offboarding checklists: where do manual leaver workflows fail?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 5:41 pm
Leaver offboarding is a lifecycle control, not an administrative task. The article shows that termination events are security events because identity persists after employment unless revocation is propagated across every system that can still authorise the user. The failure is not the checklist itself, but the assumption that one directory action closes all access. For human IAM, that assumption is dangerous because SaaS, VPN, device and badge controls often sit outside the first revocation step.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to The State of Secrets in AppSec.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when a terminated user still has access?
A: Accountability sits with the identity, IT and business owners who approved and executed the offboarding process, not with the leaver alone. If access remains, the programme failed to coordinate revocation across systems or failed to maintain evidence that the steps were completed.
👉 Read our full editorial: Leaver offboarding gaps still create orphaned accounts and audit risk
