The leaver who kept the keys
It happened — 2026Nudge Security, 2026
Research published this year keeps finding the same thing: around half of companies discover former staff still inside their software months after departure. One UK IT worker used still-live access within hours of being suspended — £200,000 of damage and a prison sentence. The company still paid.
Your version has fourteen people and healthy turnover — freelancers on and off projects, two departures this year, one of them awkward. Offboarding is an email from HR to the manager, and it usually gets most of the way there. Nobody owns the list of what a person could log into, because there is no list. And half the passwords are shared, which means they can't be taken back one person at a time even when somebody remembers to try.
This is you if Freelancers get logins that nobody remembers to close; some passwords are shared, so they can't be revoked per-person; “Change the WiFi password” is the whole leaver process.
How we run it
We start with the access map — half a day.
Every tool on any company card, every mailbox, every shared login, cross-checked against who actually works here. The research above says a first run usually finds someone; whatever we find gets closed the same day, not filed in a report.
Shared logins become named accounts.
A credential nobody owns is a credential you can never take back, so this goes first — with a password manager replacing the shared note, one person at a time, no big-bang migration.
Then the leaver drill becomes routine.
Tell us by three o'clock, and by the end of the day: sessions and sign-in tokens revoked — not just the password, the same trick a stolen laptop gets — mailbox handed to the manager, files re-owned, device wiped, second-factor methods removed.
Joiners run from the same template, in reverse.
Access granted by role on day one, which keeps the map true — so every future exit is a checklist, not archaeology.
Made boring by: the audit as a small fixed first job, then the standing drill inside any plan — told by 3pm, out by end of day. Access audit at £85/h · drill from Core £39/user/month
Real research: 2026. UK conviction: 2025, cited as the named example. The fourteen-person firm is illustrative.