The problem
An employee resigns on Friday. Their manager notifies HR, who sends an email to IT. IT creates a ticket. Someone disables the Active Directory account on Monday — maybe. But the employee still has an active Okta session, VPN credentials, access to the shared drive with customer data, a badge that opens the server room, and a laptop with cached credentials sitting in a backpack.
This is not a hypothetical. It is the default offboarding process at most large organizations. The steps are manual, distributed across multiple teams, and depend on people remembering to do things in systems they do not own. Every missed step is an open door.
The security implications are severe. Orphaned accounts — active credentials belonging to former employees — are one of the most common attack vectors in enterprise environments. A single missed deprovisioning action in a system like AWS, Salesforce, or a VPN concentrator can leave sensitive data exposed for weeks or months. In regulated industries and government agencies, this is not just a risk. It is an audit finding that triggers remediation, reporting, and potential penalties.
The coordination problem is what makes offboarding so hard to do consistently. A single departure might require actions in Active Directory, Microsoft 365, Okta, the VPN appliance, the physical badge system, the equipment tracking database, and the payroll system. Each of those systems is owned by a different team, managed through a different interface, and updated on a different timeline. No single person has visibility into whether all steps are complete. No single system tracks the full picture.
How Kinetic solves it
Kinetic orchestrates the entire offboarding workflow from a single trigger — a termination record in your HR system, or a manager-initiated request through a self-service portal. Every downstream action fires automatically, in parallel where possible, across every system involved. No emails. No tickets bouncing between queues. No hoping someone remembered to revoke the VPN.
Because Kinetic sits on top of your existing systems, you do not need to replace your identity provider, your ITSM tool, or your badge system. Kinetic connects to all of them through pre-built adapters and orchestrates the cross-system workflow that none of them can handle alone. Every action is logged, timestamped, and attributable — giving security and compliance teams the audit trail they need without asking anyone to fill out a spreadsheet.
Workflow walkthrough
- A termination event is recorded in the HR system (Workday, SAP SuccessFactors, or equivalent), or a manager submits an offboarding request through the Kinetic self-service portal.
- Kinetic validates the request against HR data and identifies the employee’s system access, assigned equipment, and active accounts.
- The Active Directory account is disabled immediately. Mailbox access is revoked in Microsoft 365. Okta sessions are terminated and the user is deactivated.
- VPN credentials are revoked at the appliance level. Remote access tokens are invalidated.
- Application-specific access is removed — Salesforce, SharePoint sites, AWS IAM roles, internal applications — based on the employee’s role profile.
- The badge system receives an automated deactivation request. Physical access is revoked across all facilities.
- Equipment recovery tasks are created and assigned — laptop, phone, monitors, access cards — with tracking through to completion.
- Payroll and benefits teams receive automated notifications with final pay calculation triggers and benefits termination dates.
- The employee’s manager and HR business partner receive a real-time status dashboard showing every completed and pending action.
- Once all steps are confirmed complete, the workflow closes with a full audit record — every action, every system, every timestamp.
Key capabilities
- Parallel execution across identity, infrastructure, and physical systems so access is revoked in minutes, not days.
- Conditional routing based on employee type, clearance level, department, or location — a departing contractor triggers different steps than a full-time employee with classified access.
- Automated approval chains for exceptions like extended email forwarding, data retention holds, or delayed equipment recovery.
- Complete audit trail capturing every deprovisioning action with system, timestamp, and result — ready for compliance review without manual documentation.
- Self-service portal for managers to initiate offboarding and track progress in real time.
- Escalation rules that flag incomplete actions after a defined SLA, so nothing stays open indefinitely.
- Equipment tracking integration that creates recovery tasks, assigns them to the right team, and tracks return through to asset disposition.
Business outcomes
- Access revoked across all systems within minutes of the termination trigger, not days or weeks.
- Orphaned account risk eliminated through automated, parallel deprovisioning across every connected system.
- Full compliance audit trail generated automatically — no manual spreadsheets, no after-the-fact reconstruction.
- IT and HR staff freed from hours of manual coordination per departure.
- Consistent offboarding experience regardless of employee type, location, or department.
- Equipment recovery rates improved through automated tracking and escalation.
- Reduced exposure to data breach risk from former employees retaining system access.
Who this is for
This is built for IT security leaders, HR operations teams, and compliance officers in large organizations where a single employee departure touches a dozen systems. It is especially relevant in government and defense environments where access control failures have regulatory consequences. If your offboarding process depends on people remembering to do things in systems they do not own, this solves that problem.