By Ayomide Otitoju
In today’s digital landscape, former employees retaining access to company systems—sometimes months after leaving—pose a serious cybersecurity risk, experts warn. A recent study reveals that 89% of ex-employees keep valid logins, while 45% maintain access to confidential company data, with nearly half admitting to continuing system access after departure.
Known as “shadow employees,” these individuals can inadvertently or intentionally expose sensitive information, disrupt workflows, or compromise corporate systems. One extreme scenario involves a marketing manager who, months after leaving, accidentally uploaded proprietary client proposals to a public cloud, leading to data leaks, reputational damage, and potential client losses.
Anna Collard, SVP Content Strategy at KnowBe4 Africa, says the phenomenon is widespread, particularly in organisations with high staff turnover or fragmented, cloud-based systems. “Access management often focuses on onboarding rather than offboarding,” she notes. “When IT and HR operate in silos, credentials and third-party accounts are easily overlooked, creating vulnerabilities.”
The risks are multifaceted. Operationally, outdated access rights can disrupt processes or allow unauthorised system changes. Reputationally, breaches by former employees erode client trust and brand credibility. Financially, rogue access can trigger regulatory fines, legal costs, and revenue losses. In 2023, a US company faced a six-figure settlement after a former IT consultant’s access was not revoked, highlighting the real-world stakes.
Collard stresses that organisations must treat offboarding as a critical cybersecurity process. Recommended measures include automating deprovisioning, integrating identity and access management (IAM) tools, involving security teams in offboarding governance, performing regular access reviews, and ensuring line managers track all systems used by exiting staff.
Emerging technologies like AI add further complexity. The HRM Report notes that 46% of African organisations are still developing AI policies, while staff increasingly use generative AI tools from work networks without proper access controls—underscoring the need for comprehensive offboarding protocols.
“Former employees shouldn’t keep the digital keys to your organisation’s kingdom,” Collard concludes. “As workplaces become more hybrid and decentralised, offboarding must be recognised as a core element of cybersecurity hygiene.”
