What breaks when departing staff keep access to company social accounts?

Why This Matters for Security Teams

When departing staff keep access to company social accounts, the break is usually not just access persistence. It is loss of authority over the corporate voice, the approval chain, and the evidence trail behind posts, replies, direct messages, and ad-account changes. That creates disclosure risk, brand damage, and compliance exposure at the exact point when leadership assumes offboarding has already closed the account. OWASP’s Non-Human Identity Top 10 is a useful reminder that unmanaged identities often outlive their owners.

NHIMG’s Ultimate Guide to NHIs notes that only 20% of organisations have formal processes for offboarding and revoking API keys, and the same lifecycle gap appears in social platform access. If a former employee can still publish, schedule, or approve content, the organisation no longer controls who is speaking in its name. In practice, many security teams discover this only after a post, deletion, or account handoff has already caused public or legal fallout.

How It Works in Practice

Social platforms often blend human user access, delegated admin roles, connected apps, and shared credentials into one operational mess. That means offboarding has to remove not only the employee account, but also every token, recovery path, connected inbox, role assignment, and third-party integration that can still act on behalf of the brand. NIST guidance on access control and identity lifecycle management, especially NIST SP 800-53 Rev 5 Security and Privacy Controls, supports the core principle: access should be explicitly authorized, reviewed, and revoked when no longer needed.

For security teams, the practical controls are straightforward but frequently incomplete:

• Remove the departing staff member from the platform, not just the SSO directory.
• Rotate any shared passwords, recovery email access, backup codes, and session tokens.
• Review admin roles, content scheduler permissions, ad accounts, and social listening tools.
• Reassign ownership to a named business owner and a security reviewer.
• Log the offboarding action so future posts can be attributed and investigated.

This is also where NHI thinking matters. A company social account behaves like a privileged non-human identity when it can publish, approve, or delete content without a human sitting behind every action. The NHIMG 52 NHI Breaches Analysis and the Meta AI Instagram Account Takeover case show how quickly platform trust collapses when identity ownership is unclear. These controls tend to break down in organisations that rely on shared logins, weak platform admin separation, or marketing teams that keep persistent emergency access because no one has built a real offboarding workflow.

Common Variations and Edge Cases

Tighter offboarding often increases operational overhead, requiring organisations to balance speed for marketing teams against the need for strong account governance. Current guidance suggests there is no universal standard for social account offboarding, so policy design has to reflect the platform and the business model rather than a generic IAM template.

The edge cases are where most incidents hide. A former employee may no longer have the password, yet still retain access through a connected mobile device, a social publishing tool, a delegated brand workspace, or a recovery mailbox that was never reassigned. In other cases, the account is “owned” by a platform vendor, but the company has not documented who can approve changes or revoke access. That is why best practice is evolving toward treating social presence as a governed NHI-like service account, with named ownership, periodic access review, and immediate revocation on separation. For teams building a more mature lifecycle model, the Key Challenges and Risks section is a useful reference point, alongside the ENISA Threat Landscape for the broader account-takeover context. The model fails most often when offboarding depends on manual handover steps that marketing, HR, and security interpret differently.

Related resources from NHI Mgmt Group

• What breaks when teams rely on shared accounts for privileged access?
• What breaks when social media access is tied to employee-owned accounts?
• What breaks when service accounts keep long-lived standing access?
• What breaks when fallback access is not governed during identity outages?