Pick the last three people who left your company. Now answer, without checking: is their email disabled? Their CRM login? The shared account they used for the shipping portal? The API key they generated for that integration nobody has touched since? The card-on-file vendor portal they set up during a busy week two years ago?
Most owners can answer the first question confidently and go quiet after that. That gap is not a people problem. It is an infrastructure problem, and it is one of the cheapest security wins available to a mid-market company.
Why Offboarding Belongs to Operations, Not HR
Offboarding usually lives on an HR checklist that was written when the company had one email system and one accounting package. Since then, the tool count has quietly tripled. Marketing bought a scheduler. Ops bought a route planner. Someone signed up for an AI writing tool with a company card. Finance added a bank portal, a payroll system, and a state tax login.
HR can revoke what HR knows about. Nobody wrote down the rest.
The result is access sprawl: a slowly growing set of credentials that outlive the people who created them. It is rarely malicious. It is usually just entropy. But entropy has consequences — a compromised dormant account is a favorite way in, and dormant accounts don't have anyone watching their login alerts.
The 30-Minute Test
You do not need a security assessment to see where you stand. You need thirty minutes and the last three departures.
For each person, walk the trail:
- Identity: email, calendar, file storage, VPN, laptop encryption key
- Core systems: ERP, CRM, helpdesk, project tool — including read-only and mobile app sessions
- Money: bank portals, payment processor, expense tools, card-on-file vendor accounts
- Shared logins: the account with a password everyone knows, where removing one person means changing it for twenty
- Machine access: API keys, SSH keys, integration connectors, webhooks they authorized under their own account
- Outside your walls: domain registrar, DNS, hosting, ad platforms, Google Business Profile, social accounts
Count how many you could confirm as closed. The number is almost never what people expect. And the items you could not confirm are the ones worth talking about on Monday.
Where the Real Risk Hides
Two categories cause most of the trouble.
The first is shared credentials. When a login belongs to "the team," nobody owns rotating it, and departures never trigger a change because changing it disrupts everyone still working. Shared accounts also destroy your audit trail — you can see that something was deleted, but never by whom.
The second is integrations authorized under a personal account. Someone connects your ERP to your shipping platform, and the connection runs on their OAuth token. Disable their user, and the sync dies silently three days later. Leave it enabled, and you are paying for a seat so a robot can keep working. Neither is a good answer. The right answer is a service account that belongs to a role, not a human.
A Fix Hierarchy That Actually Sticks
Don't start by writing a longer checklist. Start by reducing what the checklist has to cover.
Consolidate first. Every tool you retire is a door you no longer have to lock. This is one of the underrated benefits of unifying operations in a single platform — fewer logins, fewer permission models, fewer places for orphaned access to hide.
Put identity behind one front door. Single sign-on means disabling one account closes most of the building at once. It is no longer enterprise-only pricing, and it turns offboarding from an archaeology project into a single click.
Name every account. No shared logins. If a system charges per seat and you are tempted to share, price that against the cost of not knowing who did what.
Give machines their own identity. Integrations, scripts, and AI agents should run on service accounts with documented owners and scoped permissions — never on a person's credentials.
Review quarterly. Pull a user list from your top five systems and compare it to your current roster. Fifteen minutes, four times a year, catches nearly everything the checklist missed.
This Pays Off Beyond Security
Clean access control is not just defensive. It is a prerequisite for the things you probably want next.
Cyber insurance applications ask about it. Any serious buyer or lender asks about it during diligence, and a vague answer invites deeper digging. Onboarding gets faster, because the same map that tells you what to revoke tells you what to grant on day one. And if you are deploying AI agents or automation, you cannot scope their permissions properly until you know what permissions exist.
Run the test this week. If the results are uncomfortable — or if you find integrations running on a former employee's token — that is exactly the kind of untangling we do. Reach out and we'll walk your systems with you and build the map you should have had all along.