Orphaned account

Orphaned accounts are the security version of shelfware. The employee left, IT disabled their Okta and Google account, but the SaaS tools provisioned outside SSO kept billing — and kept letting the former employee log in.

The risk is asymmetric. Most ex-employees never touch the account again. The few who do — disgruntled, or with credentials sold on a breach forum — can exfiltrate years of customer data before anyone notices.

A proper offboarding checklist enumerates every tool the employee touched, not just the ones in the IDP. SeatMap maintains that inventory continuously, so the offboarding handoff is a list, not a hunt.