Quick answer
Most offboarding checklists confirm that HR’s part happened — final pay, benefits, exit interview — without ever confirming that the laptop physically came back or that its access was fully revoked. That gap is where hardware and accounts quietly outlive the person who used them.
- 71% of HR professionals report at least one departing employee kept company equipment
- Credential abuse still appears somewhere in 39% of breaches, more than any other single technique
- Insider risk incidents averaged $19.5 million a year per organization in 2025
The exit interview happens. The badge gets deactivated. HR closes the file.
Somewhere in that sequence, a laptop is supposed to make its way back to IT, and every login tied to that person is supposed to stop working.
Most of the time it does, more or less, eventually.
Sometimes it sits in a drawer at someone’s home for months, still signed into three systems nobody thought to check.
Nobody planned it that way. It is what happens when offboarding is a checklist instead of a process with an owner.
What the exit checklist doesn’t check
Most offboarding checklists were built around HR’s part of the process — final paycheck, benefits, the exit interview. IT’s part often reads as a single line: revoke access. There is rarely a verification step behind it.
The device gets the same treatment. A laptop is marked “returned” the moment someone says it will be, not the moment it is actually back in IT’s hands.
An account doesn’t stop existing when someone does
Revoking access is assumed to be instant. In practice, it depends on someone filing a ticket, and IT actually closing it, in that order.
Verizon’s 2026 Data Breach Investigations Report found that credential abuse still appears somewhere in the breach chain 39% of the time — more than any other single technique in the dataset, even as direct credential-based initial access has fallen.
Ponemon Institute’s 2026 Global Cost of Insider Risks Report put the average annual cost of insider risk incidents at $19.5 million in 2025. Credential-related incidents were the most expensive category, averaging $842,462 each — up from $779,707 the year before.
An account or a device that outlives its owner does not need malice to cause damage. A scheduled script still running under a token nobody revoked is enough to trigger a compliance finding, whether or not anyone intended harm.
What stays invisible when someone leaves
The laptop that never gets logged as missing
If nobody records the day a device should have come back, a missing laptop does not show up as an alert. It shows up, if it shows up at all, as a surprise during the next hardware audit.
The login nobody thought to check
An account can exist in dozens of applications outside the identity provider’s reach — a SaaS tool billed on a personal card, a shared spreadsheet, a CRM export. HR closes the file with no way of knowing that list even exists.
The data that left before the goodbye
A local backup, a synced folder, a screenshot of a client list — all of it can leave the building weeks before the resignation letter does, with no device involved at all.
An exit checklist tells you someone left. It does not tell you what left with them.
It’s not one moment, it’s three
- Day zero.The account is disabled, but only in the systems IT remembered to include. Anything set up outside the identity provider keeps running exactly as before.
- The first 30 days.This is the window where a device usually comes back, if it is coming back at all. Past it, recovery odds drop fast and the laptop turns into a write-off nobody budgeted for.
- Day 90 and beyond.Whatever wasn’t caught by now tends to surface somewhere else first — a license renewal invoice for a seat nobody uses, or a login attempt on an account that should not exist anymore.
Manual offboarding doesn’t scale with headcount
| Step | Manual offboarding | Managed via endpoint platform |
|---|---|---|
| Device status | Self-reported by the departing employee | Verified automatically the moment the device connects |
| Access revocation | One ticket per system, in whatever order someone remembers | Triggered from a single record, across every enrolled system |
| Local data | Unknown until someone goes looking | Visible before the account is even disabled |
| Audit trail | Reconstructed after the fact, if at all | Logged automatically at the time it happened |
It’s not a people problem, it’s a visibility problem
None of this requires a disgruntled employee. It only requires that nobody can see, in one place, every device and every account still tied to a person who is gone.
Visibility is the actual fix here — not a stricter policy that depends on an employee’s goodwill to follow, and not a longer checklist that still relies on someone remembering to tick every box by hand.
Disabling a user in the identity provider does not touch local caches. Browser-saved passwords, cached VPN certificates and locally stored API tokens keep working until the device itself is locked, wiped or physically recovered. That gap is exactly where “revoked” and “actually revoked” stop meaning the same thing.
How INGITE helps
Cloud Asset Management
Every device tied to an employee record, with recovery status tracked from the day it’s issued — so a missing laptop is a flag on day one, not a surprise at the next audit.
Cloud Remote Access
Lock or wipe a device the moment offboarding starts, whether it ever makes its way back to the office or not.
Do you know where every laptop from someone who left this year actually is?
Before the next departure gets filed away as routine, answer these honestly:
- Can you say, right now, how many devices issued to former employees were never returned?
- Does access revocation happen automatically, or does it wait on a ticket someone has to remember to file?
- If an ex-employee’s laptop connected to your network tomorrow, would anyone notice?
- Could you produce your offboarding audit trail today, or would you have to reconstruct it first?
If more than one of those answers is uncomfortable, offboarding isn’t broken because people are careless. It’s broken because nobody can see the whole list.
What happens to a laptop when an employee is offboarded?
How many companies fail to recover equipment from departing employees?
Can a former employee still access company systems after being offboarded?
How can IT teams close the gap in employee offboarding?
Know Where Every Device Actually Is
One record per employee, tracking every device from issue to return, so offboarding doesn’t depend on someone remembering to check.