Estimated reading time: 9 minutes
Cyber insurers have started asking about offboarding on their applications, says Sagiss president Travis Springer. His company’s survey suggests why. Of 1,000 US adults who left a job, 79% said a work account kept working after their last day.
“When we see new questions added to insurance applications, it is in response to an increase in claims,” Springer said in written answers to my questions.
That is his reading of the market. Sagiss has not been part of a claim involving a former employee, he said. “These incidents are common, and I have not heard of claims being denied.”
Sagiss is a managed IT and security provider in the Dallas area. It surveyed 1,000 US adults through Pollfish in September for its 2026 Managed Security Report: Employee Offboarding. All had left a job in the past five years that involved computers or company systems. The answers are self-reported. The report’s last recommendation is to hire an IT partner to run offboarding, which Sagiss sells.
What Employee Offboarding Leaves Open
Work email was the most common loose end. A third of former employees could still log in to it. A quarter still had it syncing to a phone or computer. A quarter could still open shared files.
The list runs well past email. Some could still use a company AI tool (24%) or log in to a CRM or payroll system (19%). Others could connect to the VPN (17%) or badge into the building (17%). Some 44% had three or more accounts still working.
Sensitive data stayed within reach for 64%. That included customer or client information (29%), financial records or payment systems (26%), and employee or HR records (22%). Another 17% still had admin accounts or shared company passwords.
“I could have set up my own company with that information,” one respondent wrote about a customer database.
The access often lasted. Some 30% say it ran past a month or still works today. Most expected a clean break. Of the 62% who felt confident their accounts were shut off, 78% later found one still working.
Employee Offboarding Often Stops At The Laptop
Collecting equipment was the most common offboarding step. Only 28% of former employees say their employer did it. Among those who handed back a laptop or phone, 82% still had an account working afterward.
“Most companies are careful about the laptop because it’s sitting on a desk and someone has to physically take it back,” Springer says in the report. “The accounts are harder to see.”
Other steps were rarer. Only 20% were told which accounts would be shut off and when. A third say their employer took none of the steps the survey listed.
Ownership was often missing. A third say no one clearly owned shutting off their access. Those who could name an owner split between IT (19%), HR (18%) and their manager (17%).
I asked Springer about the brass-key era, when someone leaving was supposed to mean new locks. He said the comparison holds.
“Imagine someone leaving your company and still having the keys to the office,” he said. “Today, changing the locks means shutting off all those accounts, ending their access to company systems, and changing shared passwords. And you have to know which accounts they had in the first place. You can’t shut off an account if you don’t even know it exists.”
Passpack CEO Chris Skipworth used the same image on the CINI podcast in August. He called offboarding a leading cause of small business breaches.
Layoffs, Contractors And Small Firms
Involuntary exits moved no faster. Among those laid off or let go, 59% kept access at least until later on the day they were told. More than a quarter say it lasted more than a week or never stopped.
“I’d say the planning should happen before the meeting,” Springer said. “HR and IT should already know which accounts need to be shut off and exactly when that’s going to happen. You don’t want to finish a termination meeting and then have someone start figuring out what systems the employee had access to.”
Contract and temporary workers kept the most. Some 89% had lingering access. Nearly four in five could still reach sensitive information.
Small employers left more open. At companies under 250 employees, 82% of former staff had lingering access, against 70% at companies over 1,000. Companies with 10 to 49 employees had the highest rate, at 86%. Jobs with seven or more logins left access open 87% of the time.
I asked for the cheapest fix for a small business with no IT team. “Honestly, start with a list,” Springer said. “Write down every account your employees use, and make sure someone is responsible for shutting them off when a person leaves.”
“You don’t need to spend a lot of money to start fixing that,” he said. “You need a clear process, someone to own it and a way to check that the accounts are actually closed.”
Company Data In Personal AI Accounts
Company information left with people too. Some 71% say company data sat somewhere they controlled after they left. It was most often in personal email (32%) or on a personal computer (29%). Among those asked to delete or return company files, 88% still had some.
AI adds a new place for it to sit. Some 16% had company information in an AI tool or chat history they had used for work.
I asked whether a company can get that data back once it sits in a personal AI account. “From a strict technology standpoint, there isn’t anything an employer can do to get data out of a personal account,” Springer said. That applies to email and cloud storage as well, he said.
Prevention is the only route, in his view. Data loss prevention tools can help, along with blocking personal email and cloud storage. “The most important things are strong, documented policies and procedures in the employee handbook,” he said.
AI tools also bring their own access to close. Myriad360’s Marshall Sorensen made that case about AI agents and other non-human identities on the CINI podcast. He named offboarding among the controls insurers should look for.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
What Former Employees Did With The Access
Most found the access without looking. Among those with lingering access, 60% learned of it through notifications, habit, or a former coworker. A quarter checked on purpose.
Some 47% used a former employer’s systems after leaving, even briefly. The top reasons were seeing what was left (16%), grabbing personal files (14%), and helping a former coworker (10%).
“Most people weren’t describing anything harmful,” Springer said. The survey did not ask about theft or damage. “We didn’t ask people to report specific incidents of theft or damage, so we can’t say whether that happened,” he said.
“Even if the person has good intentions, there’s no reason to leave that door open,” he added.
The survey also cannot say whether companies are improving. It has no year-by-year comparison, Springer said.
Reporting a problem did not always fix it. Of the 41% who told their old employer their access still worked, 21% saw it shut off the same day. Some 31% say it was still working more than a week later.
The bigger risk is an outsider with the password. In the report’s launch release, Springer said attackers “look for exactly those credentials.” Bitdefender’s incident responders say attackers mostly log in with stolen credentials. In Denmark, a hacker claimed a former employee’s leaked password opened the way to 8.8 million ID records.
Sophos found 71% of organizations suffered at least one identity-related breach last year. As CINI reported in May, it argued underwriters need evidence rather than self-reported answers.
On The Cyber Insurance News Podcast: Nobody Owns The Password
Passpack CEO Chris Skipworth calls offboarding a leading cause of small business breaches. In one case, a law firm’s contract staff kept access after their matter ended. “It’s a bit like not changing the lock on your front door,” he says. He also explains why MFA confirms who logged in but not who owns the credential.
FAQ – Employee Offboarding
How common is lingering access after employee offboarding?
In a Sagiss survey of 1,000 US adults who left a job, 79% said at least one work account kept working after their last day. 30% said it lasted more than a month or still works.
Do cyber insurers ask about offboarding?
Sagiss president Travis Springer says insurers have started adding offboarding questions to applications. He reads new questions as a response to rising claims.
Is collecting the laptop enough?
No. Among former employees whose equipment was collected, 82% still had at least one account working afterward.
Are small businesses more exposed?
Yes. 82% of people who left companies under 250 employees had lingering access, against 70% at companies over 1,000. Companies with 10 to 49 employees were highest, at 86%.
Can a company recover data from a former employee’s personal AI account?
Springer says no. An employer cannot technically pull data out of a personal account. Prevention means data loss prevention tools, blocking personal email and storage, and written policies.
What is the cheapest offboarding fix?
A list of every account each employee uses, one person responsible for shutting them off, and a check that the accounts are actually closed.
Related Cyber Insurance Posts
- Attackers Are Logging In, Bitdefender Says. Outside Scans Show Only Part Of The Risk.
- Small Businesses Must Prepare To Defend – And Insure – Against Cyberattacks (Opens in a new browser tab)
- Developer Laptops Are Now Credential Stores – Underwriters Should Treat Them That Way(Opens in a new browser tab)
- CyberArk Report Reveals Employee Behaviors Pose Widespread Cybersecurity Risks That Can Sink Companies(Opens in a new browser tab)
- Cyberattacks on Schools: Why Educational Institutions Are Prime Targets – KnowBe4 Report(Opens in a new browser tab)