How fast can a departure lockdown happen?

Departure lockdowns get priority scheduling. Once access is granted, the sweep of agreed systems typically completes within days, with urgent findings flagged as they are found rather than at the end.

Home / Services / Departure Lockdown

Urgent · priority scheduling

Departure Lockdown

Q: What should you check when an employee or contractor leaves?

Check their identity account and sessions, email delegation and forwarding rules, files they own, shares they created, group and admin memberships, SaaS seats, client-side access, OAuth grants and API keys tied to their account, automations they own, AI tools they connected, MFA devices, and any shared credentials they knew. Document each finding before and after removal.

Someone just left, quit, was let go, or the contractor relationship went sideways, and nobody is completely sure what they can still reach. VXSec sweeps every agreed system fast, documents what was found, and closes access with your approval, in an order that will not break your operations.

Book a 15-minute scope check Get the free offboarding checklist

FeeFixed fee confirmed at the scope check, based on systems and people involved.

SpeedPriority scheduling. Urgent findings flagged as found, not at the end.

OutputAccess sweep log: what was found, what was removed, what was kept and why.

When to use it

A resignation or termination where the person had broad access, admin roles, or client relationships.
A contractor dispute or unpaid-invoice standoff where access is now leverage.
A partner or co-founder exit that involves shared credentials and shared ownership.
A departure from months ago that was never properly closed out and still nags at you.
An agency losing a team member who held client ad accounts, stores, or automation logins.

What gets swept

The Departure Lockdown Checklist covers the person's identity account and active sessions, email delegation and forwarding rules, files they own and shares they created, group and admin memberships, SaaS seats, client-side access, OAuth grants and API keys tied to their account, automations they own, AI tools they connected, MFA devices, and any shared credentials they knew. Each item is checked, documented, and closed with approval.

Why order matters

Pulling access in the wrong order breaks things: automations fail when their owner account is disabled, files disappear when accounts are deleted before ownership transfers, and client relationships get damaged when access vanishes mid-campaign. VXSec sequences the sweep so ownership moves first, dependencies are checked, and removal comes last, with every step logged.

Sweep and evidence

Everything the person could reach, listed with evidence before anything changes.

Approved closure

You approve the removal list. Disputed or dependent items are flagged, not guessed at.

Transfer before removal

Files, automations, inboxes, and client access transfer to named owners first.

The record

A dated log of what was found and what was done. Useful for HR, legal, insurance, and clients.

After the lockdown

Most lockdowns reveal that the departure process itself is the problem. The follow-up options are a full Access and Offboarding Audit to find what other departures left behind, or a Cleanup Sprint to fix the process so the next exit is routine instead of an emergency.

Dealing with a departure right now?

Book the scope check and mention it is urgent, or email with the subject line "Departure lockdown". Priority scheduling applies.

Book a 15-minute scope check