Your Employee Left, but Their Access Didn’t: The Hidden Cybersecurity Risks of Former Staff Accounts

An employee resigns, returns their laptop, completes their handover and leaves the company. Their email account is closed, their manager is informed, and the organisation considers the departure complete.

But what if their access was never fully removed?

A former employee may still have access to cloud storage, shared documents, project management platforms, customer databases, remote access tools or third-party applications. In some cases, old credentials remain active long after the person’s final working day.

This creates a security gap that can go unnoticed for weeks or months.

The issue is not necessarily that a former employee intends to cause harm. Sometimes access remains active because nobody owns the offboarding process, a system was overlooked, or a third-party application was never included in the departure checklist.

In other situations, retained access can become part of a deliberate attempt to view, copy, alter or remove company information.

For businesses, the important question is simple: when someone leaves, does their access actually end?

This guide explains the risks of former employee accounts, the warning signs organisations should investigate, how to secure systems and how digital evidence can help clarify suspicious activity.

1. The Hidden Problem With Employee Offboarding

Most organisations have a process for collecting company property and notifying relevant departments when someone leaves.

However, physical equipment is only one part of the process.

Modern employees may have access to dozens of digital services, including:

• Corporate email accounts
• Microsoft 365 or Google Workspace
• Cloud storage and shared drives
• Customer relationship management platforms
• Accounting and payroll systems
• Internal communication tools
• Remote desktop and VPN services
• Source-code repositories
• Project management applications
• Third-party services connected through single sign-on

Disabling a company email account does not necessarily disable access to every service the employee previously used.

Some applications maintain their own login credentials. Others use personal accounts, API tokens, application passwords or long-lived sessions. Shared credentials may also remain unchanged after an employee departs.

A business can therefore believe an employee has been removed while several access routes remain available.

2. Five Ways Former Employee Access Can Remain Active

Understanding how access persists is the first step towards preventing it.

1. Forgotten cloud applications

An employee may have registered for external services using a company email address.

These could include document-sharing platforms, design tools, analytics services, communication applications or specialist business software.

If the organisation does not maintain an accurate application inventory, these accounts may be missed during offboarding.

2. Active sessions and remembered devices

Some services allow users to remain signed in across browsers, mobile devices and desktop applications.

Changing a password or disabling a primary account may not immediately terminate every active session, depending on the service and its configuration.

Organisations should review session revocation and sign-in controls rather than assuming that account deactivation alone has ended access everywhere.

3. Shared credentials

Teams sometimes share passwords for administrative accounts, software platforms or operational systems.

If a departing employee knew these credentials, they may still be usable unless the passwords are changed and access is properly reassigned.

Shared accounts also create accountability problems because activity may not be attributable to a specific user.

4. API keys and access tokens

Technical employees may have access to API keys, service credentials, automation accounts or other authentication tokens.

These credentials can allow systems to communicate without a person signing in interactively.

If credentials are not inventoried and rotated when appropriate, they may remain valid after the employee has left.

5. Third-party and delegated access

A former employee may have been granted access through an external vendor, contractor account, delegated mailbox permission or connected application.

These relationships can be overlooked when the organisation focuses only on its main identity provider.

A complete offboarding process must account for the systems and permissions connected to the employee’s role.

3. What Could Go Wrong if Former Staff Retain Access?

The consequences depend on the permissions involved and the information available to the account.

Potential risks include:

Unauthorised access to confidential information: Former staff may still be able to view internal documents, customer records, financial information or business plans.

Data copying or removal: Files may be downloaded, exported, synchronised or transferred to locations outside the organisation.

Email access: A former employee may be able to read messages, review correspondence or access information about customers and suppliers.

Account manipulation: Retained privileges may allow changes to user permissions, business records or system configurations.

Business disruption: Access to important operational systems can create opportunities for accidental or deliberate disruption.

Exposure through compromised credentials: If an old account is later compromised, an attacker may inherit access that should no longer exist.

These are potential scenarios, not proof of misconduct. A former employee account remaining active is a security-control weakness, but it does not establish that anyone used it improperly.

An investigation must distinguish between an access opportunity and evidence of actual activity.

4. Warning Signs That Deserve Investigation

Businesses should pay attention to unusual account activity, especially after an employee’s departure.

Some indicators include:

• Sign-ins after the employee’s recorded departure date
• Access from unfamiliar devices or locations
• Unexpected downloads or exports
• Unusual file-sharing activity
• New forwarding rules or mailbox permissions
• Attempts to access systems outside the person’s former responsibilities
• Changes to administrative permissions
• Unfamiliar API or application activity
• Unexpected changes to customer or financial records

Context matters.

A sign-in from an unfamiliar location may have a legitimate explanation, while an event recorded after a departure date may reflect an automated process or inaccurate account-status information.

Security logs should be reviewed alongside employment records, system configuration, time zones and the organisation’s normal activity patterns.

5. How to Investigate Suspicious Former Employee Activity

If an organisation discovers that a former employee may still have access to its systems, it should first assess the immediate risk.

The investigation should be authorised, proportionate and consistent with applicable employment, privacy and data-protection requirements.

Step 1: Establish the departure timeline

Document the employee’s final working day, the date access was supposed to be removed and the systems included in the offboarding process.

Identify which accounts were disabled, which permissions were revoked and whether any exceptions were approved.

This establishes the baseline against which later activity can be reviewed.

Step 2: Identify all relevant accounts

Review the organisation’s identity provider, application inventory and access records.

Look for accounts associated with the employee, including:

• Primary corporate accounts
• Secondary or legacy accounts
• Cloud application logins
• Shared or administrative accounts
• Remote access credentials
• Delegated permissions
• Service credentials and tokens

The objective is to establish the scope of possible access without making assumptions about misuse.

Step 3: Review available sign-in and audit records

Depending on the platform and retention settings, logs may show sign-in events, session activity, permission changes, file operations and administrative actions.

Review relevant records around the departure date and any period in which suspicious activity is alleged to have occurred.

Preserve the original records where possible and document the source, collection time and relevant time zone.

Step 4: Examine file and data activity

If there are concerns about information being copied or removed, review available file-access and sharing records.

Relevant questions may include:

• Which files were accessed?
• Were documents downloaded or exported?
• Were external sharing permissions created?
• Did access occur after the person’s departure?
• Were large or unusual groups of files involved?
• Can the activity be associated with a particular account or session?

The presence of a download event does not automatically prove that information was misused. It may be necessary to examine the surrounding activity and available corroborating evidence.

Step 5: Build a clear chronology

A timeline helps connect account activity with the organisation’s employment and security records.

For example, it may compare:

• The employee’s final working day
• Account deactivation
• Session revocation
• Sign-in events
• File access
• Permission changes
• Security alerts
• The date the issue was discovered

A well-documented timeline helps management understand what is established and which questions remain unresolved.

6. What to Do When You Discover an Active Former Employee Account

If a former employee’s account is still active, do not ignore it.

The response should be coordinated between IT, security, HR and, where appropriate, legal advisers.

Consider the following actions:

Assess the risk. Determine what systems and information the account can access and whether there is evidence of recent activity.

Preserve relevant evidence. Retain appropriate sign-in logs, audit records, mailbox information and system events before routine retention processes remove them.

Disable unnecessary access. Remove the account or revoke permissions according to the organisation’s authorised security procedures.

Revoke sessions and tokens. Review active sessions, refresh tokens, application passwords and other credentials supported by the relevant platform.

Rotate shared credentials. Change passwords and keys that the departing employee may have known, where appropriate.

Review privileged access. Check administrative roles, delegated permissions and access to sensitive systems.

Document every action. Record who authorised changes, when they occurred and what systems were affected.

If there is a credible concern about data theft or deliberate interference, avoid making unsupported accusations. Preserve the relevant evidence and obtain appropriate professional advice before taking steps that could compromise an investigation.

7. Why Evidence Preservation Matters in Employee Investigations

Internal investigations can become difficult when records are incomplete or altered.

For example, an organisation may disable an account without preserving the relevant logs, remove a mailbox before collecting its contents, or overwrite system records during routine administration.

This can make it harder to reconstruct what happened.

A sound evidence-preservation process should consider:

• Original email messages and available headers
• Identity-provider sign-in records
• Cloud audit logs
• File access and sharing history
• Endpoint security records
• VPN and remote access logs
• Relevant device information
• Administrative change history
• HR records establishing the departure timeline

Evidence should be collected only with appropriate authority and in accordance with applicable legal and organisational requirements.

Where evidence may be needed for disciplinary, civil or criminal proceedings, its collection and handling should be carefully documented.

Cyb3rsect’s guide to preserving digital evidence for cybercrime and fraud investigations explains why original records and a clear evidence-handling process matter.

8. Building a Better Employee Offboarding Security Checklist

The strongest response is to make access removal a standard, documented process rather than an informal administrative task.

A practical checklist should include:

Identity and accounts

• Disable the employee’s primary corporate account.
• Review secondary and legacy accounts.
• Revoke active sessions where supported.
• Remove unnecessary delegated access.

Applications and systems

• Review cloud applications and third-party services.
• Remove remote access and VPN permissions.
• Review access to customer and financial systems.
• Remove access to code repositories and project platforms.

Credentials

• Rotate shared passwords where necessary.
• Revoke relevant API keys and tokens.
• Review service accounts and automation credentials.
• Transfer ownership of business-critical accounts.

Devices and data

• Recover company-owned equipment.
• Follow approved procedures for preserving or wiping devices.
• Review company data stored in approved cloud locations.
• Confirm ownership of business documents and shared resources.

Verification

• Assign a person responsible for completing the checklist.
• Record completion dates and exceptions.
• Conduct a post-departure access review for sensitive roles.
• Retain an auditable record of the offboarding process.

A checklist should be adapted to the organisation’s systems, employment arrangements and legal obligations. Not every employee requires identical access controls.

9. How Cyb3rsect Can Support a Digital Access Investigation

When an organisation suspects that a former employee retained access or interacted with company information after departure, the first requirement is a clear understanding of the evidence available.

Cyb3rsect focuses on digital investigations, evidence analysis and structured reporting.

Depending on the agreed scope, available records and appropriate authorisation, an engagement may involve:

• Reviewing relevant email and account records
• Examining supplied access and audit logs
• Organising relevant digital evidence
• Developing a timeline of reported activity
• Reviewing documented file and permission changes
• Identifying gaps in the available evidence
• Preparing a structured report of findings and limitations

The organisation must have appropriate authority to provide access to the systems and records being examined. The investigation should also define which questions can realistically be answered from the available data.

Cyb3rsect does not assume that suspicious activity proves employee misconduct. The purpose is to help establish what the evidence supports, what remains uncertain and what further steps may be appropriate.

Businesses can visit Cyb3rsect to learn more about digital investigations and evidence analysis.

Conclusion: Offboarding Is a Cybersecurity Process, Not Just an HR Task

An employee’s departure should trigger more than a final payslip, equipment return and handover meeting.

Every account, permission, session and credential associated with that person’s role needs to be considered.

When access remains active, the organisation may face unnecessary exposure—even if there is no evidence that the former employee has used it.

Businesses should establish clear ownership of offboarding, maintain an accurate application inventory, review privileged access and preserve relevant records when suspicious activity is discovered.

If an incident does occur, a structured digital investigation can help reconstruct events without confusing an access weakness with proof of wrongdoing.

The employee may have left the building. Their digital access should not be left behind.