Security Awareness Briefing  //  Eriu Technology  //  Defensive Use Only

THE
LEAVING DO

They left in March. Their logins didn't.

The accounts, keys and access that outlive an employee — and why offboarding is a security job, not just HR's.

01 / What it is

Offboarding risk is the access a departed person keeps after they're gone: email, VPN, cloud apps, shared logins, their phone, API keys. It's dangerous whether they're a disgruntled ex-employee or just a dormant account an attacker finds and walks through.

02 / How it works
1
An employee leaves; HR closes the file.
2
IT access is only partly revoked — the obvious accounts, not the obscure ones.
3
Logins, tokens and app access quietly stay live.
4
Months later a dormant account is the way in — by them, or by a stranger.

→ A live account nobody's watching is the perfect foothold: no alerts, no owner, full trust.

What gets forgotten

The misses are nearly always the same:

Email & forwardingMail still flowing after they go.
VPN & remote accessA tunnel straight in.
SaaS & shared loginsTools IT never knew about.
Keys & tokensAPI keys, app passwords, their phone.
!
Offboard access the day they leaveKeep a written list of every system each person can reach, and work through it on their last day — not 'when IT gets a chance.' Disable, don't just hide. The riskiest account is the one everyone's forgotten exists.
03 / Why it's dangerous
  • Dormant accounts raise no alarms — nobody's watching them.
  • Access outlives employment by months, sometimes years.
  • Shared logins never get changed when one sharer leaves.
  • It's a gift to an attacker — a trusted account with no owner.
04 / How you stop it
  • Keep an access inventory per person — everything they can reach.
  • Revoke on the last day, from one checklist, not ad hoc.
  • Kill shared passwords when anyone who knew them leaves.
  • Use single sign-on so one switch closes many doors.
  • Audit for dormant accounts on a schedule and disable them.
They left · Their access stayed
An Eriu Technology security briefing  ·  Awareness & defence only