Someone resigns. HR processes the paperwork, the laptop comes back, the team throws a goodbye lunch. Three months later, that person's login still works on the email marketing platform, the shipping portal, the ad account, and a staging server nobody remembers spinning up. Nobody did anything wrong. There was just no list, and no owner of the list.
This is the most common security gap we see in growing companies, and it has nothing to do with firewalls or threat intelligence. It's an operations problem wearing a security costume. The fix isn't a product purchase — it's a process you can build in an afternoon and maintain in minutes a month.
Why This Gap Grows Quietly
In a ten-person company, everyone knows which tools exist. At forty people, departments buy their own software. Marketing signs up for a scheduling tool. Finance adds a payment processor. Operations connects a carrier portal. Each signup is reasonable. Collectively they create a sprawl that no single person can recite from memory.
Meanwhile, the offboarding checklist — if one exists — was written when the stack was half this size. It covers email and the ERP. It doesn't cover the forty-odd SaaS accounts, the API keys, or the contractor who still has repository access from a project that ended last year.
The risk isn't usually a vengeful ex-employee. It's that dormant accounts are attractive targets. They have valid credentials, weak or reused passwords, no MFA, and nobody watching the login alerts. They're the quietest way into your business.
Four Kinds of Access, Four Different Fixes
Treating all access the same is why offboarding checklists fail. Split it:
- Human logins — individual accounts tied to a named person. Easiest to revoke, assuming you know they exist.
- Shared accounts — the `info@` inbox, the ad account everyone uses, the admin login with the password in a chat thread. Revoking one person means rotating the credential for everyone.
- Service accounts and API keys — the credentials your integrations run on. Often created under a personal account, which means disabling the person breaks the nightly sync.
- Physical and data access — devices, VPN certificates, building badges, and the files already copied to a personal drive.
Each category needs a different action. Human logins get disabled. Shared credentials get rotated. Service accounts need to be transferred to a non-human owner before anyone leaves. Data access needs a conversation and, in some roles, a signed acknowledgment.
Make Identity the Front Door
The structural fix is single sign-on. When your tools authenticate through one identity provider, offboarding becomes a single action instead of a forty-item scavenger hunt. Disable the identity, and access to every connected system disappears at once.
Not every tool supports SSO, and some vendors charge painfully for the privilege. That's fine — the goal isn't perfection. Get your highest-risk systems behind SSO: anything touching money, customer data, or production infrastructure. Everything else goes in a password manager with shared vaults by team, so at least there's a canonical list of what exists.
The side benefit is onboarding. The same structure that lets you cut access in one move lets you grant the right access on day one, without a new hire spending their first week emailing people for logins.
Service Accounts Are Where It Breaks
This is the part that bites companies with real integrations running. Your ERP talks to your website. Your CRM pushes to your accounting system. Those connections authenticate with something — and that something was often created by whoever built the integration, under their own account.
When they leave, you face a bad choice: disable the account and break production, or leave it active and carry the risk. Most companies quietly choose the second.
Do the work now, while nothing is on fire. Inventory every integration and record what credential it uses. Move anything running on a personal account to a dedicated service account owned by the company, with its own documented purpose, scope, and rotation schedule. Scope permissions to what the integration actually needs rather than full admin. Then document it somewhere a new technical hire can find in five minutes.
Build the Trigger Into a System
Checklists that live in someone's head fail the first time that someone is on vacation. The offboarding checklist should be triggered automatically by the event that already happens — a status change in your HR or ERP record — and assigned as tasks with owners and due dates.
That's the same logic behind any good SOP: the process fires without anyone remembering to fire it. If you're already running operations through a central system, this is a natural extension of it rather than another tool to maintain.
Then schedule a quarterly access review. Pull the user list from your major systems, compare it to your current roster, and resolve the differences. It's unglamorous and it takes an hour. It's also the single most revealing hour you'll spend on security, and it's one of the first things a buyer or insurer will ask you to demonstrate.
Start With One List
If you do nothing else this week, build the inventory: every system, who owns it, who has admin, and what it connects to. You can't revoke access you can't see.
If that list turns out to be longer and messier than expected — or if your integrations are running on credentials nobody can account for — that's exactly the kind of untangling we do. Reach out and let's map it together.