Someone leaves the company on a Friday. By Monday, their email account is disabled, and their laptop is back in the pile.<\/p>
What nobody checks is their login to the project management tool they signed up for in Q3, the cloud storage folder they shared with a contractor, or the CRM access they still have from two roles ago. <\/p>
Three months later, those sessions are still active.<\/p>
This is how zombie accounts form. nNot through negligence, but through an offboarding process built around corporate IT assets that no longer reflects how people actually use software. <\/p>
The average company now runs more than 100 SaaS applications. Most offboarding checklists were written when there were three.<\/p>
<\/p>
A zombie account is an active login that belongs to someone who no longer works for you. The name is informal. The risk is not.<\/p>
What makes zombie accounts particularly dangerous is that they are valid credentials.<\/p>
There is nothing to detect. The access was granted intentionally, and the system has no reason to question it. If a former employee walks back in through that door, or if their credentials are compromised after they leave, the access is there waiting.<\/p>
Industry research finds that 50% of organizations<\/a> have discovered former employees still accessing SaaS applications months after their departure date.<\/p> For most of those organizations, the discovery was accidental rather than the result of a deliberate audit.<\/p> <\/p> <\/p> Google Drive, OneDrive, and Dropbox are where zombie access causes the most immediate damage. <\/p> These platforms are where offboarding gets messy. Files may be shared with a departing employee\u2019s personal account. Guest permissions granted during a project may never get cleaned up. And folders set to \u201canyone with the link\u201d access may still be bookmarked.<\/p> The departure triggers a license removal in the identity provider. The shared folders, external links, and personal-account shares go untouched.<\/p> <\/p> Tools like Asana, Monday.com, Notion, Jira, HubSpot, and Salesforce are frequently provisioned by team leads rather than IT. That means the offboarding checklist has no visibility into them. <\/p> A former account executive\u2019s Salesforce login, or a project manager\u2019s Notion workspace with access to company strategy documents, can persist for months without anyone noticing.<\/p> <\/p> This is the most dangerous category. <\/p> These are the tools employees signed up for using their work email. A survey platform. An AI writing assistant. A data visualisation tool. They were never formally provisioned, and they were never formally revoked.<\/p> When the employee leaves, the account does not get disabled. It sits there, attached to a work email address that may now redirect to an IT catch-all.<\/p> <\/p> <\/p> Start by pulling a list of all SaaS applications connected to your identity provider: Microsoft Entra ID, Google Workspace Admin, or Okta, if you use one. <\/p> Cross-reference with billing records, browser extension installs, and email domains showing regular login notifications.<\/p> Grip Security\u2019s 2025 SaaS Security Risks Report<\/a>, analyzing 29 million user accounts, identified 23,987 distinct SaaS applications in use across its customer base. That\u2019s far more than any IT team tracks manually.<\/p> Of those applications, 90% remained outside IT\u2019s management. <\/p> For smaller teams without a dedicated identity platform, a 30-minute review of active subscriptions and recent login notifications will surface most of the high-risk tools.<\/p> <\/p> Take the last 12 months of departures and check each name against the SaaS inventory. <\/p> For each application, ask: <\/p> Access that is months old and belongs to someone who has left is a zombie. Flag it for immediate revocation. Document what you find.<\/p> <\/p> Remove the access. Record what was found and when. Then use the audit as the baseline for an offboarding checklist that covers more than the corporate email and laptop. <\/p> Going forward, enforce multi-factor authentication on all remaining active accounts and schedule a SaaS access review every quarter. <\/p> That cadence turns a one-time cleanup into a repeatable control.<\/p> <\/p> Zombie accounts cannot be removed if no one is looking for them. The SaaS offboarding audit is the starting point.<\/p> Want to close the gaps in your SaaS offboarding process? <\/p> Contact us or schedule a consultation to run a zombie SaaS audit and build a repeatable process your team can follow on every exit.<\/p> <\/p> <\/p> —<\/p>The Three Apps Where Access Never Gets Removed<\/h2>
Cloud storage and collaboration tools<\/h3>
Project management and CRM platforms<\/h3>
The tools IT didn\u2019t know existed<\/h3>
Running the Zombie SaaS Audit<\/h2>
Step 1: Build your SaaS inventory<\/h3>
Step 2: Cross-reference against your offboarding list<\/h3>
Step 3: Revoke, document, and set a review cadence<\/h3>
Making Offboarding a Security Process<\/h2>