The Complexities of Employee Offboarding in the Age of AI
In today’s rapidly evolving technological landscape, a common scenario unfolds when an employee exits an organization: their accounts are disabled, and the offboarding process is marked as complete. However, a pressing concern lingers beneath this surface-level completion—an AI assistant utilized during their tenure may still be operational, creating potential vulnerabilities regarding company data. Information from past conversations could still be accessible and almost impossible to retrieve, posing significant security risks.
According to a survey conducted by Sagiss, a managed IT and cybersecurity provider, there are alarming findings regarding this matter. Released in October, it revealed that 24% of former employees claimed they were still able to access company AI tools or assistants even after their departure. Moreover, another 16% acknowledged that company information lingered in the AI tools’ chat history or within the assistants they had used for work. This survey was carried out in September, utilizing Pollfish and encompassing 1,000 U.S. adults who had left jobs involving the use of company technology within the past five years.
These statistics, derived from self-reported experiences rather than verified audits, evoke a vital question for Chief Information Officers (CIOs): How can organizations safeguard against unauthorized access post-termination?
Disconnection Doesn’t Equate to Vanished Information
The survey did not specify the types of AI accounts former employees claimed they could still access, as noted by Travis Springer, the president of Sagiss. Some might have been AI accounts managed by the company that were simply not disabled, while others could be personal AI accounts utilized for work-related purposes. This distinction is essential since it requires different solutions to address each issue effectively.
Springer underscored that a company can easily disable managed accounts, but any information transferred to personal AI tools remains vulnerable, residing outside the organization’s control. "Disabling an account is only part of the job. You also have to think about what company information has already been put into these tools and who controls it," he emphasized.
The problems related to offboarding employees extend beyond individual AI tools. Security consultant Dave Shackleford highlighted additional risks associated with AI-enabled Software as a Service (SaaS) applications, which can interact with business systems, alter records, and even invoke Application Programming Interfaces (APIs) on a user’s behalf. He raised concerns about service accounts, API tokens, and OAuth grants, which may seldom be tracked adequately and can last for extended periods. AI agents often inherit permissions attached to those employees who have departed, thus compounding potential security vulnerabilities.
Organizations must, therefore, take inventory of embedded AI capabilities alongside connected agents and nonhuman identities—not just the applications actively used by employees.
The Hidden Challenge of Account Management
The intricacies of account management are not purely technical. Springer shared that during routine reviews, Sagiss occasionally uncovers accounts associated with former employees because IT departments had never been informed of their departures. This lack of communication can lead to blind spots, leaving companies vulnerable to unauthorized access.
"HR knows the employee is leaving, the manager knows which tools that person used, and IT manages the accounts it knows about. Sometimes those pieces never come together," Springer observed. Alarmingly, the survey revealed that 33% of respondents felt unclear about who was responsible for terminating their access, indicating a significant communication breakdown within organizations.
As some CIOs rise to tackle the broader challenge of identifying AI tools adopted by employees—especially those used without formal IT approval—steps are being taken to improve the situation. For instance, Conal Gallagher, CIO at Flexera, noted that internal surveys were conducted to uncover informal AI usage and assess which tools were beneficial for employee productivity.
In a contrasting approach, Doug Innocenti, CIO and CISO at MoonPay, employed AI security software to scrutinize applications and assess their underlying models, ensuring a grasp of how data might be utilized by service providers.
These varying tactics highlight a fundamental prerequisite for successful offboarding: understanding which applications employees utilize and where company information could potentially be at risk.
The Importance of a Thorough Offboarding Process
Despite technological advancements like Single Sign-On (SSO), which can simplify the offboarding process by allowing IT to disable one central account instead of tracking each application individually, potential access that had been previously granted still poses a risk. Microsoft has pointed out that simply shutting off an employee’s access does not necessarily terminate every active session immediately; some applications may still accept earlier access tokens or maintain their individual sessions. Thus, IT cannot rely solely on disabling one central account.
Springer encourages a thorough examination of applications outside of SSO systems, along with shared credentials and any enduring sessions that may remain active. Furthermore, organizations must also consider which company information is stored in AI services and whether administrators retain control over that data.
To ensure effective offboarding, Springer advises companies to meticulously document which accounts were disabled, when they were turned off, and who verified the changes. This level of attention to detail is crucial in investigating any delays, overlooked applications, or unexpected login activity that may arise post-departure.
The overarching challenge remains: organizations must ascertain where they can enforce robust access removal and where control over previously shared information may be limited. "You should be able to confirm someone is off the systems instead of finding out weeks later that an account still works," Springer concluded.
The implications of these findings stress the necessity for organizations to enhance their offboarding strategies, particularly in an era where AI tools play an increasingly pivotal role in business operations. By prioritizing clear communication and tracking measures, companies can fortify their defenses against unauthorized access while ensuring the integrity and security of proprietary information remains intact—even after an employee has departed.