What Happens to Company Access When an Employee Quits? The Offboarding Gap Small Businesses Keep Missing

Also on CyberFence: CyberFence Breach Monitor for continuous breach alerts · run a free breach check on your email .

Someone on your team quits, gets a better offer, or gets let go. You handle the final paycheck, collect the laptop, maybe do an exit interview. Then work moves on. Three weeks later, nobody has thought to check whether that person can still log into your VPN, your CRM, your shared drive, or the accounting software they used every day.

That gap — the space between "they left" and "every door is actually locked" — is one of the most common, least talked-about security risks a small business carries. It doesn't show up on a balance sheet. It doesn't feel urgent. And according to the data, it's happening at most companies right now.

The Numbers Are Not Close

Only 27% of organizations automate employee offboarding at all, according to the 2026 BetterCloud State of SaaS Report — compared to 37% that automate onboarding. Companies put more effort into getting someone set up than into locking them out. The same report found that 18% of enterprises suffered a data breach tied directly to an un-offboarded former employee in just the past 12 months, and 54% of IT teams admitted they're worried their offboarding process has gaps that leave them exposed.

Independent research backs this up from a different angle. According to Gartner, only 44% of companies revoke all access rights within 24 hours of an employee's departure — meaning for the majority of departures, some login, some app, some VPN session lingers past day one. Beyond Identity's research found that 89% of former employees retain access to at least one application from their previous employer. And the Ponemon Institute has found that roughly 20% of data breaches — one in five — involve a former employee accessing systems within six months of leaving.

None of these numbers are about hackers breaking in. They're about doors that were simply never closed.

Why This Is Worse for Small Businesses, Not Better

It's tempting to assume this is an enterprise problem — a company with 100 SaaS apps and a sprawling identity system has more to lose track of than a 12-person shop. But the average organization now runs more than 100 applications, many of which aren't connected to a central identity provider, which means the "audit every app" step in a proper offboarding process is already unrealistic without automation — and small businesses are exactly the companies least likely to have that automation in place.

A small business owner handling offboarding manually is relying on memory: did IT get the message? Did anyone think to pull VPN access specifically, as opposed to just the email account? Did the departing employee ever install a personal VPN app on their own laptop that was never connected to anything the business could see or revoke? Every one of those questions is a place where access quietly survives the employee's last day — and where a business with 3 employees has just as much exposure per employee as one with 300.

The BYOD Version of This Problem

Most small businesses don't issue every employee a dedicated device with a managed VPN client. More often, employees use their own phones and laptops and install whatever cybersecurity tools they're personally comfortable with — including, often, their own individual VPN subscription that the business never set up, doesn't manage, and has no way to switch off.

That arrangement works fine while someone is employed. The problem shows up the day they leave. If an employee's VPN access to your systems runs through a personal account you have no visibility into, "revoking access" isn't a five-second toggle — it's a hope that the person simply stops trying to connect. For a business handling client data, financial records, or anything covered by a security questionnaire from a vendor or insurer, "we hope they don't log back in" is not an answer that holds up.

Why Auditors and Insurers Are Starting to Ask

This isn't just a hypothetical risk anymore — it's showing up on the paperwork small businesses are increasingly asked to fill out. Security questionnaires from clients, vendors, and cyber insurance carriers now routinely ask how quickly access is revoked after an employee departs, and whether that revocation is documented. A business that answers honestly with "we try to remember to do it that week" is not answering the question insurers and enterprise clients are actually asking, which is closer to: can you prove it happened, and how fast?

That distinction matters because insider-related incidents are not cheap when they do happen. Industry research on insider risk puts average containment time at over 80 days once an incident involving a departed employee's lingering access is discovered — and containment time is directly tied to cost. A business that can show a single admin dashboard with time-stamped access revocation has a real answer to give. A business relying on individual employees to personally close out their own VPN subscriptions does not.

What Actually Closes the Gap

The fix isn't a longer offboarding checklist — most small businesses already know, in theory, that they should revoke access on someone's last day. The fix is making that revocation something one person can actually do, in one place, without depending on memory or a chain of email requests to different tools.

• Centralized visibility. You need one place that shows every employee's active VPN and security status — not "I think everyone has it installed," but a real, current list.
• One-action revocation. When someone leaves, cutting off their access should be a single action from an admin dashboard, not a multi-step process across personal accounts and individual app settings.
• No dependence on personal accounts. If an employee's security tools live in their own personal subscription rather than a business-managed seat, you never actually had control to begin with.
• Immediate effect, not eventual effect. A revocation that takes effect the next time someone happens to sync isn't a revocation. It needs to cut access the moment you act.

This is precisely what a managed seat-based platform is built to do, and precisely what a pile of individual consumer VPN subscriptions per employee cannot do. CyberFence Teams puts every team member's protection under one admin dashboard: real-time visibility into who is actually connected and protected, non-adoption alerts if someone never turned their protection on in the first place, and instant, one-click revocation the moment someone leaves — no waiting on IT tickets, no hoping a personal account gets closed.

The Bottom Line

Employee turnover isn't going anywhere, and neither is the moment right after someone's last day when nobody double-checks every system they had access to. The businesses that avoid becoming part of the "20% of breaches involve a former employee" statistic aren't the ones with the longest offboarding checklist — they're the ones where cutting off access is a single, immediate action, not a hope that a personal app gets deleted.

If your team's VPN protection is a patchwork of individual subscriptions you can't see or control, you don't have an offboarding process — you have an assumption. A managed platform with real admin control turns that assumption into something you can actually verify, every time someone walks out the door for the last time.

Want to go deeper? Read how CyberFence Breach Monitor works , the free CyberFence breach check tool , or the CyberFence password strength tool .