{"id":3119,"date":"2026-06-20T12:00:00","date_gmt":"2026-06-20T12:00:00","guid":{"rendered":"https:\/\/www.treehouse-it.com\/?p=3119"},"modified":"2026-05-11T08:57:18","modified_gmt":"2026-05-11T12:57:18","slug":"the-zombie-saas-audit-finding-the-3-apps-your-former-employees-still-access","status":"publish","type":"post","link":"https:\/\/www.treehouse-it.com\/index.php\/2026\/06\/20\/the-zombie-saas-audit-finding-the-3-apps-your-former-employees-still-access\/","title":{"rendered":"The \u201cZombie\u201d SaaS Audit: Finding the 3 Apps Your Former Employees Still Access"},"content":{"rendered":"

Someone leaves the company on a Friday. By Monday, their email account is disabled, and their laptop is back in the pile.<\/p>

What nobody checks is their login to the project management tool they signed up for in Q3, the cloud storage folder they shared with a contractor, or the CRM access they still have from two roles ago. <\/p>

Three months later, those sessions are still active.<\/p>

This is how zombie accounts form. nNot through negligence, but through an offboarding process built around corporate IT assets that no longer reflects how people actually use software. <\/p>

The average company now runs more than 100 SaaS applications. Most offboarding checklists were written when there were three.<\/p>

<\/p>

What a Zombie Account Actually Is<\/h2>

A zombie account is an active login that belongs to someone who no longer works for you. The name is informal. The risk is not.<\/p>

What makes zombie accounts particularly dangerous is that they are valid credentials.<\/p>

There is nothing to detect. The access was granted intentionally, and the system has no reason to question it. If a former employee walks back in through that door, or if their credentials are compromised after they leave, the access is there waiting.<\/p>

Industry research finds that 50% of organizations<\/a> have discovered former employees still accessing SaaS applications months after their departure date.<\/p>

For most of those organizations, the discovery was accidental rather than the result of a deliberate audit.<\/p>

<\/p>

The Three Apps Where Access Never Gets Removed<\/h2>

<\/p>

Cloud storage and collaboration tools<\/h3>

Google Drive, OneDrive, and Dropbox are where zombie access causes the most immediate damage. <\/p>

These platforms are where offboarding gets messy. Files may be shared with a departing employee\u2019s personal account. Guest permissions granted during a project may never get cleaned up. And folders set to \u201canyone with the link\u201d access may still be bookmarked.<\/p>

The departure triggers a license removal in the identity provider. The shared folders, external links, and personal-account shares go untouched.<\/p>

<\/p>

Project management and CRM platforms<\/h3>

Tools like Asana, Monday.com, Notion, Jira, HubSpot, and Salesforce are frequently provisioned by team leads rather than IT. That means the offboarding checklist has no visibility into them. <\/p>

A former account executive\u2019s Salesforce login, or a project manager\u2019s Notion workspace with access to company strategy documents, can persist for months without anyone noticing.<\/p>

<\/p>

The tools IT didn\u2019t know existed<\/h3>

This is the most dangerous category. <\/p>

These are the tools employees signed up for using their work email. A survey platform. An AI writing assistant. A data visualisation tool. They were never formally provisioned, and they were never formally revoked.<\/p>

When the employee leaves, the account does not get disabled. It sits there, attached to a work email address that may now redirect to an IT catch-all.<\/p>

<\/p>

Running the Zombie SaaS Audit<\/h2>

<\/p>

Step 1: Build your SaaS inventory<\/h3>

Start by pulling a list of all SaaS applications connected to your identity provider: Microsoft Entra ID, Google Workspace Admin, or Okta, if you use one. <\/p>

Cross-reference with billing records, browser extension installs, and email domains showing regular login notifications.<\/p>

Grip Security\u2019s 2025 SaaS Security Risks Report<\/a>, analyzing 29 million user accounts, identified 23,987 distinct SaaS applications in use across its customer base. That\u2019s far more than any IT team tracks manually.<\/p>

Of those applications, 90% remained outside IT\u2019s management. <\/p>

For smaller teams without a dedicated identity platform, a 30-minute review of active subscriptions and recent login notifications will surface most of the high-risk tools.<\/p>

<\/p>

Step 2: Cross-reference against your offboarding list<\/h3>

Take the last 12 months of departures and check each name against the SaaS inventory. <\/p>

For each application, ask: <\/p>