Active leavers are former employees or contractors whose access remains live after they leave an organisation. The term covers accounts, badges, VPN access and privileged entitlements that should be removed or disabled through the joiner-mover-leaver process and access recertification.
What active leavers are and why they matter
Active leavers are not just a paperwork issue, they are an access-control failure mode. When accounts, badges, VPN paths, or privileged entitlements remain live after separation, the organisation has a former insider with continuing reach into systems, facilities, or data that should already be closed off.
The practical concern is that leaver status often spans more than one control plane. HR may record the departure, but identity governance, badge systems, remote access, privileged tooling, SaaS tenants, and application entitlements all need to converge on the same revocation outcome.
Because of that, active leavers are best understood as a lifecycle problem rather than a single account issue. If one path is removed but another remains active, the person can still authenticate, reuse a session, or reach a privilege level that no longer matches their role.
How active leavers happen
Active leavers usually appear when offboarding is fragmented, delayed, or incomplete. Common failure points include missing HR triggers, manual approval bottlenecks, shared administrative ownership, and incomplete inventory of where the leaver had access in the first place.
They are especially common where access is granted outside a central process, for example through emergency exceptions, direct manager requests, contractor onboarding, or one-off privilege assignments. Those paths often bypass the same checks used for joiner and mover changes, so the leaver record never fully reaches every system that depends on it.
Session persistence also matters. Even when a user ID is disabled, active tokens, federated sessions, API credentials, or privileged browser sessions can keep working until they expire or are explicitly revoked. That is why deprovisioning needs to cover both identity objects and the material that proves or enables access.
Security consequences of stale access
Active leavers widen the window for account takeover, data theft, sabotage, and unauthorised remote entry. A former employee or contractor may retain enough access to browse mailboxes, pull source code, change configurations, or use privileged consoles long after the relationship has ended.
They also create a trust problem. A control environment that assumes separation has already been completed can fail silently if dormant access remains usable. That makes active leavers a classic example of access creep turning into exposed privilege, especially when the remaining access includes admin roles, service portals, or remote connectivity.
Where badges or physical access are still live, the risk extends beyond cyber systems. A stale building credential can combine with retained digital access to create a broader insider exposure, including theft of devices, sensitive documents, or access to unattended workstations.
Why recertification and offboarding controls are central
Active leavers are usually caught, or missed, through the same mechanisms that support joiner-mover-leaver discipline: authoritative source changes, entitlement reviews, deprovisioning workflows, and periodic access recertification. The goal is not just to disable a person, but to verify that every access path tied to that person has been removed or transferred appropriately.
Good practice is to treat leaver handling as a dependency map, not a single action. If the organisation knows where access lives, it can confirm removal across human accounts, privileged roles, badges, shared tools, remote access, and any delegated access that was granted during employment or contract work.
For a deeper operational view of offboarding and revocation, see the Joiner-Mover-Leaver (JML) Guide, the Employee Offboarding Security Guide, and the broader IAM and IGA Basics guide.
Risk and Threat Considerations
Active leavers are dangerous because they preserve a realistic insider attack path after the employment or contract relationship has ended. The longer access remains live, the more opportunity exists for misuse, accidental exposure, credential reuse, or deliberate abuse before the organisation notices.
Failure mechanism: Offboarding gaps, delayed deprovisioning, and incomplete entitlement discovery leave a former user with one or more live access paths, such as accounts, sessions, badges, or privileged roles.
Impact: The result can be unauthorised data access, privilege misuse, physical entry, fraud, sabotage, or post-departure persistence inside systems that should already be closed to that individual.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PS-4 — Personnel Termination | Defines termination as a control event requiring access removal after departure |
| AC-2 — Account Management | Requires account lifecycle governance, including disabling or removing departed users | |
| IA-5 — Authenticator Management | Covers the lifecycle of authenticators and revocation of credentials that remain usable after exit | |
| Recommendation — Use PS-4 to revoke all access and recover organisational assets when personnel leave. Apply AC-2 to disable or remove stale accounts and track account status changes. Use IA-5 to invalidate credentials, tokens, and other authenticators after offboarding. | ||
| CIS Controls v8 | 5 — Account Management | Addresses account lifecycle hygiene and removal of inactive or no-longer-needed access |
| Recommendation — Implement CIS-5 to remove departed users' access and disable inactive accounts promptly. | ||
| ISO/IEC 27001:2022 | A.5.11 — Return of assets | Covers recovery of assets and access-bearing items when people leave |
| Recommendation — Apply A.5.11 to retrieve badges, devices, and other access-bearing assets at exit. | ||
Practitioner Guidance
Why practitioners should care: Active leavers are a lifecycle control issue, not just an HR admin task. Security teams need clear ownership for proving that every access path tied to the leaver has actually been removed, including systems that are outside the main directory or IAM stack.
What to watch for: Repeated offboarding delays, manual exceptions, missing asset inventories, and unclear ownership of contractor or badge revocation are all warning signs. A clean termination record is only meaningful when it is matched by verified access removal across the relevant systems.
Practitioner takeaway: Treat leaver handling as a verification problem, not a promise problem, and close it only when identity, privilege, session, and physical access have all been accounted for.
Related resources from NHI Mgmt Group
- What happened in the demo account left active in production scenario and what does it reveal?
- Why do Active Directory service accounts complicate zero trust programs?
- How should security teams govern Active Directory service accounts?
- What is the difference between direct access and effective access in Active Directory?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org