What it is
Employee departure is a moment where identity hygiene routinely fails. HR closes the employment record; IT disables the primary SSO account; but the long tail of individual SaaS accounts, personal-device-linked apps, and cross-tenant integrations (Slack, project management, marketing platform, code hosting, e-sign) often survives for weeks or months.
Why it matters
A departed employee with retained access is either a direct insider risk (if the departure was contentious) or an inherited outside exposure (if the departed employee's credentials later leak in an unrelated breach and the attacker discovers they still work). Either path leads to a compromise no active-employee monitoring will catch.
The check behind the finding
Compare your list of active sign-ins in email and shared tools against current staff.
Closing it
This is closed from the inside, by whoever manages the firm's accounts, and it means working through every service the person could sign in to, not only the main one. It cannot be read from outside, so it is not part of an outside reading. Ask for the list of services each departed person could use, and the date each one was closed.