Notifications
Clear all
Topic starter
12/06/2026 9:03 pm
TL;DR: Vendor offboarding fails when organisations treat contract closure as an administrative task instead of an identity event, leaving third parties with lingering access to systems, data, and devices, according to Zluri. The practical issue is not only removal speed, but whether lifecycle ownership, audit trails, and access revocation are actually enforced.
NHIMG editorial — based on content published by Zluri: Vendor Management 4-Step Vendor Offboarding Checklist
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: What breaks when vendor offboarding is treated as paperwork instead of lifecycle governance?
A: Access remains active after the contract ends, which means the vendor can still reach systems, data, or devices that should have been removed.
Q: Why do third-party vendors create more offboarding risk than many internal users?
A: Vendors often touch multiple systems for a short period, which makes their access harder to track and easier to forget at exit.
Q: How do teams know whether vendor offboarding is actually working?
A: They should be able to show a complete list of vendor entitlements, evidence that each one was revoked, proof that devices were returned, and records that data deletion or retention decisions were approved.
Practitioner guidance
- Build a complete vendor access inventory Map every SaaS app, VPN, internal system, device, and physical access point a vendor can touch before offboarding begins.
- Separate data retention from data deletion Decide which vendor-related data must be retained, which must be deleted, and who signs off on each action.
- Require cross-functional offboarding ownership Assign finance, security, legal, and system owners clear tasks for settlement, entitlement removal, contract closure, and compliance evidence.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step vendor offboarding checklist structure for IT, finance, security, and legal teams.
- Practical examples of what to back up, delete, and document during contract termination.
- How the platform claims to surface active SaaS apps and users before revocation.
- The article's full sequence for handling devices, contracts, licenses, and exception tracking.
👉 Read Zluri's vendor offboarding checklist for access removal and lifecycle control →
Vendor offboarding: the governance gap teams keep missing?
Explore further
12/06/2026 10:52 pm
Vendor offboarding is lifecycle governance, not contract administration. The article describes a familiar failure pattern: organisations close the commercial relationship but leave the identity relationship unfinished. That gap spans SaaS access, device return, data deletion, and legal evidence, which means offboarding has to be governed as a full lifecycle event. Practitioners should treat vendor termination as a controlled deprovisioning process, not an administrative afterthought.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, which shows how slowly revocation can lag behind exposure in practice.
A question worth separating out:
Q: Who is accountable when vendor access is left behind after termination?
A: Accountability should sit across security, legal, finance, and the system owners who granted the access in the first place. Offboarding is cross-functional because it spans access removal, contract closure, payment settlement, and compliance evidence. If ownership is unclear, residual access usually survives the process.
👉 Read our full editorial: Vendor offboarding is an identity governance problem, not admin cleanup
