The News
Sagiss, a Dallas-Fort Worth-based managed IT and security services provider, has published the 2026 Sagiss Managed Security Report: Employee Offboarding, based on a Pollfish survey of 1,000 U.S. adults who left a computer-dependent job within the past five years. The report finds that 64% of former employees could still access sensitive company data after their departure, including customer records, financial systems, and HR files. Critically, 33% of respondents said no one at their former employer clearly owned the responsibility for shutting off access, and 79% reported at least one work account remained active after their final day.
Analyst Take
The Offboarding Gap Is a Security Architecture Problem, Not an HR Problem
The Sagiss findings put a number on something security practitioners have long suspected: identity lifecycle management breaks down at the exit, not just at the entry. The statistic that 82% of workers whose equipment was physically collected still had at least one account or system working afterward is particularly striking. Collecting hardware has become a ritual comfort, a visible action that signals closure. The actual attack surface, sitting in SaaS credentials, VPN certificates, shared service accounts, and forgotten OAuth grants, remains largely invisible to the teams responsible for closing it.
This is not primarily a policy problem. Most organizations have offboarding policies. The failure is architectural. When identity is federated across dozens of SaaS applications, cloud platforms, and legacy systems, no single deprovisioning action in an HR or IT ticketing system reaches everything. The 33% figure for organizations where “no one clearly owned shutting off access” reflects the predictable outcome of a distributed identity sprawl with no authoritative source of truth.
The Government Sector Analog Is Stark
While the Sagiss survey covers the U.S. workforce broadly, the implications are sharper in regulated and government environments. ECI Research’s Google GovTech Survey found that 56.0% of respondents selected “Lack of shared security context between on-premises systems and cloud platforms” as the biggest barrier to achieving a unified view of application security posture across multi-cloud or hybrid environments. That fragmentation is exactly the condition that makes offboarding dangerous: if security teams can’t see across their own hybrid estate in real time, they certainly can’t deprovision across it cleanly. A former contractor’s cloud credentials don’t expire on their own, and a forgotten token to a government API endpoint is a far more consequential exposure than access to a shared marketing folder.
The compliance angle compounds the risk. ECI Research’s Google GovTech Survey also found that 26.0% of respondents selected “Securing machine-to-machine secrets management and API tokens” as their organization’s biggest hurdle when implementing a Zero Trust architecture at the application layer. This matters because modern application environments don’t just grant access to humans. Former employees often leave behind service accounts, API keys, and pipeline secrets that were provisioned in their name or under their ownership. Those artifacts don’t show up on an HR offboarding checklist, and they persist long after the human account is deactivated.
What ITDMs Should Act On
For IT decision-makers, the Sagiss report is a useful forcing function for a conversation that often stalls: who actually owns identity lifecycle management end-to-end? The answer is rarely one team. HR initiates the departure. IT deactivates the primary directory account. But the SaaS applications, the cloud console roles, the developer platform tokens, and the shared credentials stored in team password managers require a separate, automated sweep. Organizations that have not invested in an identity governance and administration (IGA) platform with automated deprovisioning connectors are operating with a manual process that, by design, has gaps.
The size differential in the Sagiss data is worth flagging for procurement decisions: 82% of workers at companies with fewer than 250 employees had lingering access, compared to 70% at companies with more than 1,000 employees. Larger organizations are doing better, but a 70% failure rate is still deeply unacceptable as a baseline. The marginal improvement at scale suggests that headcount alone doesn’t solve the problem. Structured, tool-assisted offboarding workflows do.
For developers and platform engineers, the takeaway is more specific. Every OAuth grant, personal access token, and CI/CD pipeline secret issued to an individual represents a deprovisioning obligation. Organizations that have moved to short-lived credentials, workload identity federation, and secrets rotation by default are materially better positioned. Those still issuing long-lived API keys tied to named users are carrying risk that the Sagiss data suggests will likely materialize.
Looking Ahead
The market pressure on identity security vendors, particularly those addressing the SaaS access and IGA space, will intensify as findings like these make the business case more concrete. Expect accelerating investment in automated deprovisioning tooling, joiner-mover-leaver workflow automation, and continuous access certification products over the next 12–24 months. Vendors that can demonstrate real-time coverage across both cloud and on-premises systems, not just Active Directory and Entra ID, will have a meaningful competitive advantage. The gap between collecting a laptop and actually revoking access is where the next generation of identity security products will compete.
For CISOs and CIOs, the harder long-term question is organizational, not technological. The 33% of organizations where no one owned the offboarding access process points to a governance gap that tooling alone cannot fix. The function of “identity owner” needs to be a named accountability, not a shared assumption. As AI agents, service accounts, and non-human identities multiply inside enterprise environments, the deprovisioning challenge will only grow more complex. Organizations that build clean identity lifecycle practices now, while the problem is primarily human-shaped, will be far better positioned when the non-human identity surface becomes the dominant exposure vector.
Stay Ahead of Application Development Trends
Get weekly analyst insights, research notes, event coverage, and AppDevANGLE updates delivered directly to your inbox.
Subscribe for Weekly Insights
Join technology leaders, practitioners, and GTM teams following the trends shaping modern software delivery.
Looking for deeper research access?
Explore ECI Research reports, survey insights, and market analysis through the ECI Research Portal.
