Former Employees Still Have Access? Run a Zombie SaaS Audit

Article Summary: Most businesses shut off email and collect devices when someone leaves. What often gets missed is everything else: SaaS logins, shared folders, saved sessions, and permissions across tools nobody thought to review. A zombie SaaS audit helps you find those accounts, remove access, and tighten your offboarding process before it turns into a security problem. 

When an employee leaves, most businesses disable email, collect devices, and move on. What often gets missed is everything else: access to cloud storage, project tools, CRMs, and other SaaS apps that stay active long after the person is gone. 

That is how zombie accounts happen. Not because someone ignored the process, but because offboarding often still focuses on email, laptops, and obvious systems while today’s work happens across dozens of apps. Most businesses are using far more SaaS tools than their offboarding checklist was ever built to handle. 

In this article, you’ll learn what zombie SaaS accounts are, where they usually hide, and the three types of apps most likely to be missed during offboarding. You’ll also see how to run a practical SaaS audit so your team can close those gaps before they create unnecessary security risk. 

What zombie SaaS accounts really mean for your business 

A zombie account is an active login tied to someone who no longer works for your company. The name may sound informal. The risk is not. 

What makes these accounts dangerous is simple: the access was legitimate when it was created. That means there may be no alert, no obvious failure, and no reason for the platform to question it. If a former employee still has access, or if those credentials are compromised after they leave, the door may still be open. 

Industry research finds that 50% of organizations have discovered former employees still accessing SaaS applications months after their departure date. In many cases, businesses do not find it through a planned review. They find it by accident. 

The 3 SaaS apps most likely to be missed during offboarding 

Cloud storage and collaboration platforms 

Google Drive, OneDrive, and Dropbox are some of the most common places zombie access lingers. This is where offboarding gets messy fast. Files may have been shared with a personal account. Guest access may have been granted for a project and never removed. Old links may still allow access long after someone leaves. 

The company disables a user in its main system, but the shared folders, outside users, and old permissions stay in place. That creates real risk. Sensitive files, internal documents, pricing, contracts, and operational information may still be accessible even though the employee is gone. 

Project management and CRM tools 

Asana, Monday.com, Notion, Jira, HubSpot, and Salesforce often slip through the cracks because they are not always set up by IT. In many businesses, these tools are added by department heads or individual teams. That means they may never make it onto a formal offboarding checklist in the first place. 

A former sales employee may still be able to log into Salesforce. A previous project manager may still have access to planning documents in Notion. If no one checks those systems directly, access can stay active for months without anyone realizing it. 

The apps IT never knew about 

This is usually the most overlooked category and often the riskiest. These are the tools employees signed up for using their work email: a survey platform, an AI writing assistant, a data visualization tool, or another subscription no one formally approved or tracked. 

Because those tools were never officially provisioned, they are rarely officially removed. When the employee leaves, the account often keeps running in the background, still tied to the business and still potentially accessible. 

How to run a zombie SaaS audit without overcomplicating it 

Start by building a SaaS inventory 

Begin with the systems you can see. Pull a list of all SaaS applications connected to your identity provider, whether that is Microsoft Entra ID, Google Workspace Admin, or Okta, if you use one. Then compare that list against billing records, browser extension installs, and email domains sending regular login notifications or subscription messages. 

This matters because most businesses are using more SaaS tools than they realize. Grip Security’s 2025 SaaS Security Risks Report, which analyzed 29 million user accounts, identified 23,987 distinct SaaS applications in use across its customer base. It also found that 90% of those applications remained outside IT’s management. 

For smaller businesses without a dedicated identity platform, even a focused review of subscriptions, admin consoles, and login notifications can surface a large portion of the highest-risk apps. 

Compare that list against past employee departures 

Once you have your list, compare it against your offboarding records from the last 12 months. 

For each application, check a few simple things: 

• Does the platform have an admin console? 

• Can you see which users are still active? 

• When did the account last log in? 

If the account belongs to someone who has left and it is still active, that is a zombie account. Flag it. Remove it. Document it. This is often where businesses realize the issue is not one missed account. It is a pattern in the offboarding process. 

Remove access and make the process repeatable 

The immediate step is straightforward: revoke the access and record what you found. The bigger value comes from what happens next. Use the audit to strengthen your offboarding checklist so it covers more than email and equipment. Build SaaS review into every departure.

Make sure shared access, app-specific permissions, and lesser-known tools are part of that process, not an afterthought. Then set a recurring review cadence. A quarterly SaaS access review is a practical baseline for many businesses, especially when combined with multi-factor authentication on all remaining active accounts. That turns a one-time cleanup into an ongoing control. 

Conclusion  

Zombie accounts are easy to miss, but they create real risk. If former employees still have access to files, systems, or business tools, your offboarding process is leaving gaps behind. A SaaS offboarding audit is one of the clearest ways to close that gap. It helps you find leftover access, reduce unnecessary exposure, and make sure your offboarding process actually reflects how your business uses technology today. 

If you want to tighten your offboarding process and reduce hidden SaaS risk, Atekro can help. Contact us to schedule a SaaS access audit and get a clear plan to identify lingering accounts, close security gaps, and strengthen your offboarding process moving forward. 

FAQ 

What is the difference between a zombie account and an inactive account? 

A zombie account belongs to someone who has left the business and no longer should have access. An inactive account may belong to a current employee who just does not use the platform often. Both can create risk, but zombie accounts are more urgent because there is no valid business reason for the access to remain. 

What is the fastest way to find zombie SaaS accounts? 

Start with your identity provider, whether that is Microsoft Entra ID, Google Workspace Admin, or Okta. Review connected apps and active users, then compare that list against employee exit records from the last 12 months. That will usually uncover the most obvious gaps first. 

Can shared SaaS accounts create the same problem? 

Yes. Shared accounts can make offboarding harder because access is not tied clearly to one person. When possible, individual accounts are the better option because they create a cleaner audit trail and make access removal more straightforward. 

How often should a SaaS access audit happen? 

A quarterly review is a strong baseline for many businesses. Employee departures should also trigger an immediate review so access is removed at the time of exit rather than waiting for the next sch