In New England, we’re experts at “closing things down.” We know how to winterize a summer cottage on Sebago Lake, how to shut down a garden before the first frost, and how to properly store a snowblower when May (finally) arrives. We understand that leaving a pipe uninsulated or a door unlatched is just asking for trouble.
But when it comes to business technology, many of us are leaving the front door wide open and the lights on: long after the guests have left the party.
At Peak Technology Consulting, we see it all the time: “Ghost Employees.” These are former staff members who have moved on to new jobs, perhaps even started working for a competitor in Portland, yet they still have active logins to Microsoft 365, internal Slack channels, and proprietary CRMs.
It’s the IT equivalent of moving out of an apartment but keeping the keys and coming back to use the Wi-Fi and raid the fridge. Except, in this case, the fridge is filled with your most sensitive client data and your bank account.
The Financial Vampire: SaaS Sprawl and Wasted Licenses
Let’s start with the part that hits your wallet first. We call it “The Financial Vampire.”
When an employee leaves, your HR department likely handles the final paycheck and the exit interview. But if your IT process isn’t tightly synced, those Microsoft 365 Business Premium licenses keep ticking. According to research, the average mid-sized business is overspending on software licenses by nearly 30% simply because they aren’t deprovisioning accounts properly.
Think about it. If you’re paying $22 per user for M365, plus another $15 for a specialized SaaS tool, and maybe $10 for a project management seat, you’re looking at nearly $50 a month for someone who doesn’t even work for you anymore. Multiply that by five “ghosts” over a year, and you’ve just set $3,000 on fire.
As one of the leading technology companies in Maine, Peak Tech focuses on lean, efficient operations. We don’t believe in paying for “ghosts.” Proper offboarding isn’t just a security checklist; it’s a direct injection of cash back into your bottom line.
The Security Leak: Data Theft and the “Disgruntled” Factor
Now, let’s talk about the scary stuff. Most employees leave on good terms, but even the best intentions can lead to a security disaster.
When a former employee still has access to their OneDrive or SharePoint folders, the temptation to “take a few files for reference” is incredibly high. In fact, studies show that over 50% of employees admit to taking company data with them when they leave.
It starts innocently: a template they designed, a contact list they built. But once that data leaves your “digital perimeter,” it’s gone. If that contact list ends up in the hands of a competitor, your “friendly” departure just cost you your most valuable leads.
And then there’s the rare, but devastating, “disgruntled” scenario. An ex-employee with a grudge and an active login can delete critical files, change passwords to lock you out, or post inappropriate content on company social media.
The Deep Dive: Microsoft 365 Permissions
M365 is the backbone of most Maine businesses, but it’s also where most offboarding mistakes happen. Simply “resetting the password” isn’t enough.
Why? Because of Tokens.
Modern cloud apps use “access tokens” that stay active on devices (laptops, phones, tablets) for days or even weeks. If you just change a password but don’t “Revoke All Sessions,” that ex-employee can still open their Outlook on their iPhone and read every new email coming into the company.
At Peak Tech, we implement a “Nuclear Option” for offboarding that includes:
- Wiping the device (if it’s company-owned) or removing company data (if it’s personal/BYOD).
- Converting the mailbox to a Shared Mailbox (so you don’t have to pay for the license but can still see the emails).
- Revoking all active refresh tokens to force a logout on every single device.
- Removing the user from all Multi-Factor Authentication (MFA) methods to prevent them from “approving” their own re-entry.
The Great New England Hardware Hunt
Getting a laptop back shouldn’t feel like a high-stakes bounty hunter mission. Yet, for many technology companies in Maine, “unrecovered assets” are a major headache.
We’ve heard stories of laptops sitting in trunks in Bangor, tablets “lost” in moves to New Hampshire, and specialized equipment gathering dust in a garage in South Portland.
If a device isn’t returned, you aren’t just losing $1,000 in hardware. You’re losing an unmanaged endpoint. If that laptop isn’t encrypted and it gets sold on Craigslist, whoever buys it might have a direct window into your company’s internal network.
Why This Matters for Maine Small Businesses
You might think, “We’re just a small shop in Augusta, who would want to hack us?”
The reality is that hackers don’t always target you; they target vulnerability. An unmonitored account belonging to a former bookkeeper is a goldmine for “Business Email Compromise” (BEC) attacks. If a hacker can get into that “ghost” account, they can send invoices to your clients that look 100% legitimate because they are coming from your actual domain.
As we discussed in our post about AI and the evolution of tech, threats are getting smarter and faster. Your defense needs to be just as agile.
The Ultimate 10-Step Offboarding Checklist
To help you sleep better at night, we’ve put together a simplified version of the checklist we use at Peak Tech. If you can’t check all 10 of these boxes when someone leaves, give us a call.
- Disable the Account: Block sign-in immediately across M365 and all local directories.
- Revoke All Sessions: Force a logout on all mobile devices and web browsers.
- Secure the Mailbox: Convert to a shared mailbox and give the manager access.
- Wipe the Hardware: Remotely wipe company data from the laptop or phone.
- Change Shared Passwords: If they knew the “general” password for the front door, the alarm, or a shared social account, change it now.
- Audit SaaS Access: Check third-party tools (Adobe, HubSpot, Zoom, etc.) and remove their seat.
- Remove from MFA: Ensure their personal phone isn’t the “key” to your company’s digital locks.
- Redirect Phone Numbers: If they had a company-assigned VOIP number, ensure it rings to their replacement.
- Physical Access: Collect badges, fobs, and keys. If you use digital keypads, delete their code.
- Archive Data: Ensure their local files (on the laptop) are backed up to a central company repository before the machine is wiped for the next hire.
Don’t Let Your Past Compromise Your Future
Offboarding isn’t about lack of trust; it’s about professional discipline. It’s about ensuring that your business remains your business.
At Peak Technology Consulting, we specialize in making these transitions seamless. We act as the “Digital Janitors,” ensuring that when someone walks out the door, their digital footprint is erased, your data is locked down, and your licenses are reclaimed.
Stop paying for ghosts. Stop leaving your data to chance. Whether you’re in the heart of Portland or up in the County, let’s make sure your “winterization” for employee exits is ironclad.
Ready to secure your exit process? Contact Peak Tech today for a comprehensive IT audit.
