How should teams detect access that outlives a terminated employee when different identity systems all look correct on their own?

Why This Matters for Security Teams

Offboarding failures rarely show up as a single broken control. HR may mark the employee as terminated, the IdP may disable the primary account, and the PAM platform may look clean while a local laptop account, cloud token, or API key still works. That is why teams need cross-system mismatch detection rather than confidence in one “source of truth.” The risk is broader than human access because NHI controls often outlive the employee who created them, as discussed in the Ultimate Guide to NHIs.

NHI Mgmt Group reports that 91.6% of secrets remain valid five days after notification, which is a useful reminder that revocation lags are often visible only when records are compared across systems. The practical issue is sequence: an access path can remain active after the employee is gone because a downstream system did not receive, process, or enforce the termination event. Teams that monitor only one layer tend to miss the mismatch until audit, incident response, or fraud investigations expose it. In practice, many security teams encounter lingering access only after the former employee has already used it.

How It Works in Practice

The most effective pattern is to treat identity as a chain of assertions, not a single record. HR establishes employment status, the IdP governs interactive sign-in, IGA tracks entitlement changes, PAM governs elevated sessions, and host records reveal whether local or cached credentials still exist. Detection begins by joining those records on the same person or workload and then checking whether the termination event propagated in the expected order. If one system says “disabled” while another still shows active authentication, the disagreement is the signal.

Practitioners usually look for four classes of mismatch:

• Terminated in HR, but still active in the IdP or federation token cache.
• Disabled in the IdP, but still enabled in PAM, VDI, SaaS, or SSH certificate stores.
• No active directory account, but a local admin or service account still authenticates on hosts.
• Entitlements removed from IGA, but persistent API keys, refresh tokens, or long-lived secrets still validate.

Current guidance from the OWASP Non-Human Identity Top 10 and NIST Cybersecurity Framework 2.0 supports continuous visibility, rapid revocation, and evidence-based access review rather than trust in static attestations. For NHI-heavy environments, that means correlating lifecycle events with secret inventories, token issuance logs, and host telemetry. The NHI Lifecycle Management Guide is useful here because offboarding is not complete until every credential form factor has expired or been revoked. These controls tend to break down in hybrid environments with shadow IT, unmanaged endpoints, or disconnected SaaS apps because the termination event never reaches the last place where access still exists.

Common Variations and Edge Cases

Tighter offboarding correlation often increases operational overhead, requiring organisations to balance detection speed against integration complexity. That tradeoff becomes more visible in environments with multiple directories, mergers, contractors, and shared accounts, where identity ownership is already fragmented. Best practice is evolving, and there is no universal standard for this yet, but the trend is toward event-driven reconciliation with clear evidence of propagation rather than nightly spot checks.

Some cases need special handling. Shared admin accounts can make the terminated user look absent everywhere while their prior knowledge still enables misuse. Break-glass accounts may be intentionally retained, so the key question is whether access is time-bound, monitored, and independently approved. Service accounts are another edge case: the employee may be gone, but the workload still depends on a secret, certificate, or key that was never rotated. That is why lifecycle controls for credentials matter alongside human offboarding, a pattern reinforced by NHI breach analysis in the 52 NHI Breaches Analysis. The most reliable programs also keep immutable timestamps for termination, disablement, revocation, and last successful authentication so investigations can distinguish delay from failure. In practice, mismatches usually surface first in stale local accounts, delayed SaaS deprovisioning, or token reuse after revocation.

Related resources from NHI Mgmt Group

• How should security teams correlate email, IdP, and SaaS signals to detect identity attacks that look legitimate in each system on its own?
• How should security teams automate identity lifecycle management across HR and directory systems?
• How should teams extend identity governance into on-prem systems without opening inbound access?
• How should security teams detect identity outliers in access reviews?