SOC 2 Type II · ISO 27001 · 1,400 security teams
SOC 2 Type II · ISO 27001 · 1,400 security teams
Palisade
Palisade
Risk score82/100open
Next page/
Home
Identity · 2 October 2026 · 6 min read
The account that outlives the job
Most breaches we review start with a login that should not exist any more. Here is how to find yours in an afternoon.
Written by Priya Raman · Security researcher
Offboarding is a checklist, and checklists get skipped on a Friday. The result is an account with real rights and no owner.
Start with payroll
Export the list of people you pay. Export the list of accounts that can sign in. The difference is your first finding.
Then look at admins
- Who holds a global role and has not signed in for 30 days
- Which service accounts have a human password
- Which guests still sit in private channels
An unused admin account is a door with the key left in it.
Close those first. The rest can wait until Monday.
Make it a habit
Run the comparison every night, not every quarter. The gap between a leaver and a closed account should be measured in hours.
1. Match the directory to payroll
2. Flag accounts with no person
3. Close admins first, then everyone else
If you do only one thing this month, do this one.
End of post
Identity · 2 October 2026 · 6 min read
The account that outlives the job
Most breaches we review start with a login that should not exist any more. Here is how to find yours in an afternoon.
Written by Priya Raman · Security researcher
Offboarding is a checklist, and checklists get skipped on a Friday. The result is an account with real rights and no owner.
Start with payroll
Export the list of people you pay. Export the list of accounts that can sign in. The difference is your first finding.
Then look at admins
- Who holds a global role and has not signed in for 30 days
- Which service accounts have a human password
- Which guests still sit in private channels
An unused admin account is a door with the key left in it.
Close those first. The rest can wait until Monday.
Make it a habit
Run the comparison every night, not every quarter. The gap between a leaver and a closed account should be measured in hours.
1. Match the directory to payroll
2. Flag accounts with no person
3. Close admins first, then everyone else
If you do only one thing this month, do this one.
End of post
Identity · 2 October 2026 · 6 min read
The account that outlives the job
Most breaches we review start with a login that should not exist any more. Here is how to find yours in an afternoon.
Written by Priya Raman · Security researcher
Offboarding is a checklist, and checklists get skipped on a Friday. The result is an account with real rights and no owner.
Start with payroll
Export the list of people you pay. Export the list of accounts that can sign in. The difference is your first finding.
Then look at admins
- Who holds a global role and has not signed in for 30 days
- Which service accounts have a human password
- Which guests still sit in private channels
An unused admin account is a door with the key left in it.
Close those first. The rest can wait until Monday.
Make it a habit
Run the comparison every night, not every quarter. The gap between a leaver and a closed account should be measured in hours.
1. Match the directory to payroll
2. Flag accounts with no person
3. Close admins first, then everyone else
If you do only one thing this month, do this one.
End of post
Start here
Run the sweep on your domain.
Tell us where to look. We set up a read-only connection with you on a short call, and you see your own findings the same day.
We will sweep
- Identity providerNot connected
- Cloud accountsNot connected
- DevicesNot connected
- Code repositoriesNot connected
Start here
Run the sweep on your domain.
Tell us where to look. We set up a read-only connection with you on a short call, and you see your own findings the same day.
We will sweep
- Identity providerNot connected
- Cloud accountsNot connected
- DevicesNot connected
- Code repositoriesNot connected
Start here
Run the sweep on your domain.
Tell us where to look. We set up a read-only connection with you on a short call, and you see your own findings the same day.
We will sweep
- Identity providerNot connected
- Cloud accountsNot connected
- DevicesNot connected
- Code repositoriesNot connected