Offboarding gap
An offboarding gap is the time or the systems in which a departing employee, contractor or vendor keeps access after their work has ended. It happens when deprovisioning is manual, slow or incomplete, for example when the main directory account is disabled but app accounts, API keys, shared passwords or remote access remain.
How it works
When someone leaves, IT may close their primary login while SaaS apps, local accounts, VPN profiles and personal tokens stay live. A disgruntled former insider, or an attacker who later obtains those credentials, can keep signing in. The longer the gap and the more systems involved, the harder the leftover access is to find.
A real example
In an April 2022 SEC filing, Block said a former employee downloaded Cash App Investing reports containing some US customer information, and that the reports were accessed without permission after the person's employment ended.
Source: Block, Inc. Form 8-K (Item 8.01) — Block, Inc. (filed with the US Securities and Exchange Commission), 2022-04-04
How to stop it
Trigger deprovisioning automatically from the HR termination event, cover every connected app and credential type, and confirm removal with a same-day access review for privileged leavers.
Related terms
Sources
- Block, Inc. Form 8-K (Item 8.01) — Block, Inc. (filed with the US Securities and Exchange Commission), 2022-04-04
Last reviewed Oct 2, 2026