AI in the Workplace: 24% of Former Employees Retain Access

Active sessions, reusable tokens, and out-of-scope accounts can survive an employee's departure. According to a Sagiss survey published in October, 24% of former employees were still able to use an AI tool, and 16% reported leaving company data in chats. CIOs detail their methods for mapping these usages and regaining control.

Central Deactivation: Sessions and Tokens May Persist

Microsoft indicates that revoking access for an employee does not immediately terminate all active sessions. Some applications may continue to accept previously issued tokens or maintain their own sessions, meaning that deactivating a centralized account does not simultaneously remove access everywhere. Ensuring a reliable departure requires more than just a closed ticket: it is essential to document which accounts have been deactivated, on what date, and who verified the changes, then investigate delays, forgotten applications, and unexpected logins. The challenge also lies in distinguishing areas where access removal is possible from those where control over already shared information is limited. Organizations should be able to confirm that a person is no longer in the systems, rather than discovering weeks later that an account is still active.

Fragmented Responsibilities: 33% Find Offboarding Poorly Assigned

33% of respondents believe that the responsibility for terminating their access was unclear or that no service was handling it. Sagiss reports discovering during routine reviews accounts linked to departing employees that IT had not been informed about, while sifting through inactive accounts. The IT department cannot close what it does not know: HR holds the information about the departure, the manager has the list of tools used, and IT knows the accounts it is aware of, without any guarantee that these elements align.

Reported Scope: 24% Retain Access, 16% Leave Data Behind

According to Sagiss, 24% of former employees report still being able to access an AI tool or assistant from their previous company after their departure, while 16% claim that company data remains in an AI tool or in chat history. This survey, based on participants' statements, was conducted by Pollfish in September 2026 among 1,000 American adults who left positions using enterprise technologies in the past five years. These results are published in October in the 2026 Managed Security Report: Employee Offboarding.

Personal Accounts and Managed Tools: Two Different Risks

Sagiss did not specify what types of accounts remained accessible to departing employees. Some cases involve AI accounts managed by the company that may not have been deactivated, while others pertain to personal accounts used for professional purposes. The relative frequency of these scenarios is not specified, but the distinction changes the response: deactivating an account is not sufficient if company information has been integrated into tools beyond the administrators' reach.

AI-Enabled SaaS and Technical Identities Expand the Surface

AI-enabled SaaS applications can query systems, modify records, and call APIs on behalf of users, multiplying points of concern. Service accounts, API tokens, and OAuth permissions create blind spots, with sometimes long lifetimes and patchy oversight, especially since AI agents may inherit permissions from employees. While SSO simplifies deactivation by consolidating identity management, the issue of already assigned access remains. Recommendations highlight the need to examine applications outside of SSO, shared credentials, persistent sessions, as well as to inventory integrated AI features, connected agents, and non-human identities, all while keeping in mind the company data already hosted by providers and the actual degree of administrative control.

What CIOs Are Already Doing: Inventorying and Assessing Tools

CIOs are working to make AI usage visible, including unapproved ones. At Flexera, Conal Gallagher surveyed employees to identify informal usages and tools deemed useful, revealing applications adopted by sales teams. At MoonPay, Doug Innocenti describes a technical approach using AI security software to examine applications and assess their models, including potential data usage by vendors, to conduct an independent review and select the retained tools. These efforts aim to establish a prerequisite for reliable offboarding: knowing which tools are in use and where company information is circulating.