DEV Community

Kokal Limited
Kokal Limited

Posted on • Originally published at strongpassfactory.com

The 10-Minute Offboarding Checklist Every Dev Team Ignores

#passwordsecurity #onlinesafety #cybersecurity

When an employee leaves, how fast can you kill their access? If it's not "under 10 minutes," you have a problem.

In our analysis of SMB security incidents this year, failure to revoke former-employee access was the root cause of 34% of preventable breaches — more than phishing, more than weak passwords. The Verizon 2026 DBIR pegs 28% of breaches on internal actors, and ex-employees with live credentials are a big slice of that.

These failures are quiet and boring. No zero-day, no APT — just a token nobody rotated. Which is exactly why they're so preventable.

Why it breaks in small teams

Enterprises wire HRIS into their IdP, so termination auto-deactivates accounts. Most of us run manual processes that fall apart under pressure:

  • No account inventory — 20+ SaaS subscriptions and nobody knows who has access to what.
  • SSO blind spots — you kill the IdP, but they signed up for three tools directly with a personal-looking email, bypassing SSO entirely.
  • Shared vault chaos — if they owned the team password vault, revoking them can lock everyone out.
  • API keys and PATs — the scariest one for devs. Personal access tokens keep working long after the human is gone.

The NCSC measures the risk window in hours, not days.

The core checklist

Run these in order, starting the minute notice is given:

# 1. Disable the identity provider account first (Entra ID / Google Workspace / Okta)
# 2. Revoke ALL active sessions — invalidate live tokens, don't just reset the password
gcloud identity ... # or your IdP's "sign out everywhere"

# 3. Rotate the shared vault master + any secrets they could read
# 4. Remove from every SaaS app individually (CRM, billing, PM, email)

# 5. Kill API keys and personal access tokens — check every provider
gh auth status              # audit GitHub PATs
aws iam list-access-keys --user-name former.employee
Enter fullscreen mode Exit fullscreen mode

Passwords are polite; session and token revocation is what actually locks the door. A disabled account with a live OAuth token is still an open door.

Automate what you can. Even a simple runbook — a checklist in your wiki with owners assigned per step — beats scrambling under emotional pressure the day someone gets walked out.

The goal isn't enterprise tooling. It's a repeatable process you can run in 10 minutes, every single time.

Originally published on strongpassfactory.com.

Top comments (0)