Ask most security teams what their biggest access risk is and they will describe phishing, credential stuffing, or a misconfigured cloud bucket. Almost nobody says "an account we forgot to disable eight months ago," but that is exactly the access most breach post-mortems eventually trace back to.
Why orphaned access is invisible until it isn't
Orphaned access does not trigger alerts. A dormant account with valid credentials looks identical to an inactive employee taking a long vacation, until someone uses it. Most detection tooling is built to catch anomalous behavior, not the mere existence of access that should have been revoked months earlier.
The four places it hides
- Identity provider accounts that were disabled but never had downstream app access revoked
- OAuth grants to third-party apps that outlive the employee who authorized them
- API keys and personal access tokens created outside any central inventory
- Contractor and vendor accounts that never had an offboarding trigger in the first place
Why pen tests usually miss it
A penetration test is scoped to test specific systems within a specific window: it is not designed to enumerate every account across every SaaS tool your company has ever connected. Orphaned access is a governance and process gap, not a vulnerability a scanner will flag.
What actually closes the gap
The fix is not a one-time cleanup: access accumulates continuously as people join, move roles, and leave. It needs to be a continuous, automated check: compare who should have access against who actually does, across every app, on a short interval, and revoke or flag the difference before it becomes a finding.
That is the core loop AccessRevoke runs every 15 minutes by default: scanning for HR events, comparing access state across your stack, and closing the gap automatically or flagging it for approval, entirely inside your own infrastructure.