Every business has a version of this story.
A developer leaves the company on a Friday. By Monday, their Active Directory account is disabled — but their access to the company's GitHub repositories, cloud storage, AWS console, and a handful of SaaS tools nobody remembered they used? Still wide open. Three months later, a routine audit surfaces the issue. Nobody knows how much data was accessed in the window. Nobody knows if it was accessed at all.
This scenario plays out thousands of times a day across U.S. businesses. It's not a story about malicious ex-employees (though that happens too). It's a story about the mechanics of identity management breaking down at the seams where people enter, move within, and exit your organization.
In the identity security world, this is called the joiner-mover-leaver (JML) problem — and in 2026, it has quietly become one of the most exploited attack surfaces in the enterprise.
What Is Workforce Identity Lifecycle Management?
Workforce identity lifecycle management is the discipline of systematically controlling what access employees, contractors, and third-party users have — from the moment they're onboarded to the moment they're offboarded — and every role change in between.
It sounds straightforward. In practice, it's one of the messiest, most neglected corners of IT security.
The problem isn't just that businesses forget to revoke access when someone leaves. It's that most organizations don't have a complete, accurate picture of who has access to what at any given moment. Identity sprawl — the unchecked accumulation of accounts, permissions, and entitlements across dozens of systems — means that even well-intentioned IT teams are working from incomplete maps.
According to the 2025 Verizon Data Breach Investigations Report, credential abuse remained the top attack vector for the fifth consecutive year. A significant portion of those abused credentials belonged to former employees or over-privileged current ones — people who either shouldn't have had access anymore, or who had far more access than their role required.
The Three Phases Where Identity Security Breaks Down
Joiners: When New Employees Get Too Much, Too Fast
Onboarding is a race. HR is trying to get a new hire productive on day one. IT is provisioning accounts, setting up devices, and responding to a ticket queue that never empties. In that rush, the path of least resistance is almost always to copy another user's permissions — typically the person the new hire is replacing or working alongside.
This is called permission cloning, and it's a silent killer.
When you clone permissions, you don't just copy the access that person legitimately needs today. You copy every permission that user accumulated over years of role changes, project work, and one-off access requests that were never cleaned up. You inherit their privilege bloat.
Now multiply that across dozens of new hires a year. Within months, your organization has a workforce where almost nobody has access scoped precisely to their role. And when attackers compromise a single account through phishing or credential stuffing, they inherit everything that user was over-provisioned with.
The fix sounds simple — provision access based on role, not based on copying another user — but it requires having a clean, current role-based access control (RBAC) framework in place. Most mid-size businesses don't.
Movers: The Most Underestimated Phase of the Lifecycle
Internal promotions, lateral moves, department transfers, project rotations — these are routine business events. They're also where identity management most reliably falls apart.
When someone moves from the finance team to operations, they get the new access they need for their new role. Their old finance system access? Usually stays. Because offboarding access from a previous role requires coordination between HR, IT, and often individual application owners — and that coordination rarely happens with any consistency.
The result is access accumulation: employees quietly building up permissions across systems that no longer reflect anything about their current job function. Over time, a 5-year employee who's had three internal moves might have legitimate access to payroll records, customer databases, a decommissioned CRM, and an old SharePoint site that still holds sensitive merger documents.
This is the insider threat scenario that keeps CISOs up at night — not because they assume malice, but because they know it only takes one compromised account to make all that accumulated access someone else's problem.
Leavers: The Phase With the Most Expensive Failures
The leaver scenario is the one most people think about first, and the one most organizations still manage worst.
A 2024 study by Productiv found that 58% of IT leaders have discovered active accounts belonging to former employees during routine audits. In many cases, those accounts had been dormant for months. In others, they had been actively used — by whom, and for what, often couldn't be determined.
The offboarding problem is structural. HR triggers the termination. IT disables Active Directory. But the organization's actual application estate — the SaaS tools, the cloud consoles, the project management platforms, the shared credentials stored in a browser — exists far outside the reach of a single directory.
In 2026, the average mid-size business uses between 130 and 200 SaaS applications. Many of those are provisioned by individual departments or business units without IT's involvement. When someone leaves, disabling their corporate SSO (single sign-on) will revoke access to applications connected through SSO — but not to any application where that user created an independent account with their work email address.
That gap is often invisible until something goes wrong.
Why JML Is Getting Harder, Not Easier
Several converging trends are making workforce identity lifecycle management more complex in 2026:
The growth of the contingent workforce. Contractors, freelancers, part-time workers, and gig employees now make up a significant share of many business workforces. These workers are often provisioned quickly, managed loosely, and offboarded inconsistently. Their access patterns look different from full-time employees, but most identity systems treat them the same.
SaaS sprawl. Every new tool a department adopts creates a new identity record that needs to be created, maintained, and eventually deactivated. With departments spinning up new SaaS subscriptions without IT visibility, the surface area for orphaned accounts grows faster than anyone can track.
Remote and hybrid work. When provisioning and offboarding happen remotely, the informal human checkpoints that used to catch mistakes — a manager walking a badge to IT, a team lead noticing an ex-employee still in the Slack channel — disappear.
AI-powered access escalation. Threat actors are increasingly using AI to identify and exploit orphaned accounts. Automated scanners can probe for valid-but-inactive credentials across common SaaS platforms and cloud environments at scale, making the window between offboarding and access revocation more dangerous than ever.
What a Modern Identity Lifecycle Framework Looks Like
Fixing the JML problem doesn't require ripping out your existing identity infrastructure. It requires building a consistent, automated, and auditable process around the systems you already have.
Start With an Authoritative Identity Source
Everything in a mature identity lifecycle program flows from one authoritative source of truth: usually your HR information system (HRIS). When HR creates a new employee record, that event should automatically trigger provisioning workflows. When HR marks someone as terminated, that event should automatically trigger deprovisioning — across every connected system, not just Active Directory.
This requires integration between your HRIS and your identity governance platform, which is a project many organizations deprioritize. It's also one of the highest-ROI identity investments you can make.
Implement Role-Based Access Control — and Keep It Clean
RBAC means defining what access each role in your organization legitimately requires — and provisioning exactly that access when someone takes on that role. No more, no less.
This requires upfront work to map your roles and their associated entitlements. It also requires ongoing governance to keep those role definitions current as your business evolves. But once it's in place, onboarding becomes a matter of assigning a role rather than copying a user, and internal moves trigger automatic access adjustments rather than access accumulation.
Automate Access Certification Campaigns
Access certification — also called an access review — is the periodic process of confirming that every user's current access is still appropriate. In a mature program, this happens automatically: managers receive a list of their reports' current access, confirm or revoke each entitlement, and that confirmation is logged for audit purposes.
Without automation, access certification is a spreadsheet exercise that happens annually at best, and never actually catches everything. With automation, it can be continuous.
Don't Forget Service Accounts and Shared Credentials
The JML framework typically focuses on human users. But service accounts — the accounts used by applications, automated processes, and integrations — have a lifecycle too. When the developer who created a service account leaves, who maintains it? When the integration it supports is decommissioned, does the account go with it?
Service accounts and shared credentials are a significant source of orphaned access that most organizations don't account for in their identity lifecycle programs.
Close the SaaS Discovery Gap
You can't govern access to applications you don't know exist. A discovery process for SaaS applications used across your organization — often called a SaaS management or shadow IT discovery initiative — is a prerequisite for comprehensive JML governance. Once you know what applications your workforce is using, you can work toward connecting them to your identity governance platform and ensuring they're covered by your provisioning and deprovisioning workflows.
How Layer27 Helps Businesses Close the JML Gap
Workforce identity lifecycle management is a cross-functional problem that spans IT, HR, compliance, and business operations. Most mid-size businesses don't have the internal resources to build and maintain a mature JML program on their own — which is where a managed services partner becomes essential.
Layer27's Co-Managed IT offering is designed specifically for businesses that have some internal IT capacity but need strategic support on complex initiatives like identity governance. Our team works alongside your IT staff to architect, implement, and operationalize JML workflows that align with your HRIS, your existing directory infrastructure, and your application estate.
For businesses building toward Zero Trust architecture, JML is a foundational component — and it's embedded in the security frameworks we help clients design and maintain.
Our Protect Pro and Safe Start packages include identity security baseline assessments that surface orphaned accounts, over-privileged users, and provisioning gaps that most businesses don't know they have. If your organization has never conducted a systematic review of who has access to what, that's typically the starting point.
On the detection side, our Managed Detection & Response (MDR) and 24x7 SOC services monitor for behavioral anomalies associated with compromised or misused accounts — including the patterns that orphaned accounts and over-privileged users tend to generate when they're being exploited. Early detection is critical in these scenarios, because the damage from an abused former-employee account can compound quickly.
For organizations with formal compliance requirements — HIPAA, PCI-DSS, CMMC, or SOC 2 — a well-documented JML program is not optional. Our Compliance services help businesses build the access review documentation, audit trails, and policy frameworks that regulators and auditors expect.
Practical Steps You Can Take This Quarter
You don't need a multi-year identity transformation project to start reducing JML risk. Here are four things you can do in the next 90 days:
1. Audit your offboarding process end-to-end. Walk through your last five terminations. For each one, identify every system the individual had access to. Then verify that access was revoked in each system. Document the gaps you find — they're your highest-priority remediation targets.
2. Build a SaaS application inventory. Even an informal inventory — a spreadsheet compiled from IT records, department interviews, and expense reports — gives you a baseline for understanding the scope of your identity governance problem.
3. Establish a formal access review cadence. Even a semi-annual, spreadsheet-based access review is better than nothing. Ask managers to confirm that every member of their team has access appropriate to their current role. Document the review and the resulting changes.
4. Connect your HRIS to your directory. If your HR system and Active Directory (or Azure AD / Entra ID) aren't integrated, that integration project should move up your priority list. Automated provisioning and deprovisioning triggered by HR events is the single most impactful structural change most mid-size businesses can make to their identity lifecycle program.
The Bottom Line
Workforce identity lifecycle management doesn't generate the urgency of a ransomware headline or the novelty of an AI-powered threat. It's an operational discipline — the kind of work that prevents breaches rather than responding to them.
But in 2026, with credential abuse driving the majority of breaches, with SaaS sprawl creating thousands of orphaned access records across the average business, and with attackers using automation to find and exploit the gaps you don't know you have, the JML problem is no longer a background item on your security roadmap.
It's a front-burner risk with a measurable blast radius.
The good news is that it's a solvable problem. It doesn't require exotic technology or an enterprise security budget. It requires consistent process, the right tooling, and a partner who can help you see the full scope of your identity estate — and govern it accordingly.
Ready to find out where your identity lifecycle gaps actually are?
Layer27's team can walk you through a no-obligation identity security assessment that surfaces orphaned accounts, provisioning gaps, and over-privileged users across your environment. Contact us at /contact to start the conversation.