Access Reviews & Offboarding Audits
Verify terminated employees no longer have access to your systems
What this engagement covers
The service
When employees leave - especially those terminated under difficult circumstances - their access needs to be fully revoked across every system, SaaS tool, cloud account, and code repository. Our Access Review service audits your offboarding process and validates that former employees have zero residual access to your environment.
What we test
We audit access across your entire technology stack: Active Directory and Entra ID accounts, email and collaboration tools (Google Workspace, Microsoft 365, Slack), cloud consoles (AWS, Azure, GCP), source code repositories (GitHub, GitLab, Bitbucket), SaaS applications, VPN and remote access, API keys and service accounts, SSH keys, CI/CD pipelines, and shared credential stores. We also review whether MFA was properly deprovisioned and whether any personal devices retained corporate access.
Scoping & Assessment Depth
Black Box Assessment
Zero-KnowledgeSimulates an external adversary targeting Access Reviews & Offboarding Audits with no internal credentials, source code, or architecture documentation. Assesses perimeter exposure, unauthenticated attack paths, and edge resilience.
Gray Box Assessment (Recommended)
CredentialedSimulates an authenticated user, tenant, or insider threat within Access Reviews & Offboarding Audits. We evaluate role segregation, authorization boundaries, privilege escalation, and business logic flaws across user tiers.
White Box / Source-Assisted
Full-KnowledgeConducted with direct access to architecture schematics, configuration files, and API/code documentation. Eliminates blind spots and provides exhaustive coverage of security mechanisms governing Access Reviews & Offboarding Audits.
Attack Surface & Vulnerability Vectors
Active Accounts After Termination
Rigorous testing and validation to uncover Active Accounts After Termination across your Access Reviews & Offboarding Audits environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Orphaned Service Accounts and API Keys
Rigorous testing and validation to uncover Orphaned Service Accounts and API Keys across your Access Reviews & Offboarding Audits environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Unrevoked SSH Keys and Certificates
Rigorous testing and validation to uncover Unrevoked SSH Keys and Certificates across your Access Reviews & Offboarding Audits environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Retained Access to Source Code Repos
Rigorous testing and validation to uncover Retained Access to Source Code Repos across your Access Reviews & Offboarding Audits environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Active SaaS Licenses for Former Staff
Rigorous testing and validation to uncover Active SaaS Licenses for Former Staff across your Access Reviews & Offboarding Audits environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
Shared Passwords Not Rotated Post-Departure
Rigorous testing and validation to uncover Shared Passwords Not Rotated Post-Departure across your Access Reviews & Offboarding Audits environment. We produce deterministic proof-of-concept exploits to verify exploitability without risking service stability.
How we run it
We work with your HR and IT teams to identify recently departed employees and contractors, then systematically verify that every access point has been revoked. We cross-reference identity providers with individual application access, check for orphaned accounts, review shared credentials that may need rotation, and validate that offboarding procedures are being followed consistently.
Identity provider account status verification
Rigorous technical execution, boundary verification, and manual exploitation testing targeting identity provider account status verification across your access reviews & offboarding audits deployment.
Email and collaboration platform access audit
Rigorous technical execution, boundary verification, and manual exploitation testing targeting email and collaboration platform access audit across your access reviews & offboarding audits deployment.
Cloud console and IAM access review
Rigorous technical execution, boundary verification, and manual exploitation testing targeting cloud console and iam access review across your access reviews & offboarding audits deployment.
Source code repository access validation
Rigorous technical execution, boundary verification, and manual exploitation testing targeting source code repository access validation across your access reviews & offboarding audits deployment.
SaaS application access enumeration
Rigorous technical execution, boundary verification, and manual exploitation testing targeting saas application access enumeration across your access reviews & offboarding audits deployment.
VPN, SSH, and remote access checks
Rigorous technical execution, boundary verification, and manual exploitation testing targeting vpn, ssh, and remote access checks across your access reviews & offboarding audits deployment.
API key and service account review
Rigorous technical execution, boundary verification, and manual exploitation testing targeting api key and service account review across your access reviews & offboarding audits deployment.
Offboarding process and policy assessment
Rigorous technical execution, boundary verification, and manual exploitation testing targeting offboarding process and policy assessment across your access reviews & offboarding audits deployment.
What you receive
Findings land in your tracker as you go, not only in a PDF at the end. Retest is in scope, not a change order.
- Complete access audit report per departed employee
- Residual access findings with risk ratings
- Orphaned and dormant account inventory
- Shared credential rotation recommendations
- Offboarding process gap analysis
- SaaS and cloud access verification matrix
- Policy and procedure improvement recommendations
- Executive summary for leadership and compliance
What we usually find
The issues this engagement surfaces most often. Yours will differ, but this is the shape of it.
Who this is for
Auditor-Ready Compliance Crosswalk
| Framework | Control Section | Testing Evidence & Report Deliverable |
|---|---|---|
| SOC 2 Type II | CC4.1, CC7.1, CC7.2 | Technical testing evidence validating system boundaries, access restrictions, and vulnerability identification controls. |
| ISO/IEC 27001:2022 | Control A.8.8 & A.8.20 | Management of technical vulnerabilities and network security verification through independent technical assessments. |
| NIST SP 800-53 Rev 5 | CA-8, RA-5, SC-7 | Rigorous penetration testing and technical vulnerability assessment supporting federal compliance and continuous monitoring. |
| HIPAA Security Rule | 45 CFR § 164.308(a)(8) | Formal technical evaluation verifying the integrity of ePHI safeguards, network segmentation, and privileged access safeguards. |
| PCI DSS v4.0 | Requirement 11.4 & 11.4.3 | Adversary-driven external and internal penetration testing with application-layer validation and vulnerability remediation verification. |
| GDPR Article 32 | Art. 32(1)(d) | Documented evidence of regular testing, assessing, and evaluating the effectiveness of technical measures protecting personal data. |
Findings are mapped to SOC 2, ISO 27001, NIST 800-53, HIPAA, PCI-DSS, GDPR, so the report drops into an audit package rather than needing to be translated first. If you need the readiness work behind one of those, that is a separate engagement.
Frequently Asked Questions
Direct answers on scoping, methodology, compliance validation, and deliverables.
Our Access Reviews & Offboarding Audits service combines deep manual testing with automated verification. We cover: Complete access audit report per departed employee, Residual access findings with risk ratings, Orphaned and dormant account inventory, Shared credential rotation recommendations, Offboarding process gap analysis. Every engagement includes reproducible proof-of-concept exploits, developer-ready remediation guidance, and a free retest.
Yes. Findings are directly mapped to SOC 2, ISO 27001, NIST 800-53, HIPAA, PCI-DSS, GDPR control requirements. The resulting report is auditor-ready and formatted for immediate submission to SOC 2 CPAs, PCI QSAs, and enterprise vendor risk assessment teams.
Yes. Every Lorikeet Security engagement includes free retesting within 30 to 60 days to validate that your remediation patches successfully resolve the identified vulnerabilities before your final report is issued.
Typical active testing turnaround is 2-5 days, with critical findings reported immediately via your Talon portal so your engineering team can begin remediation without waiting for the final PDF.
Pricing starts from $3,000. We scope the engagement in one call based on your environment's surface area, user roles, and complexity, providing a transparent, fixed-price quote with no hidden change orders.
Scope it in one call
Tell us what is in scope and we come back with a fixed price and a start date. No discovery-call maze, no hourly estimate that moves.
