Residual Access

Anyone who works at a company gets access: a user account, a password, maybe a chip card for the door. When the person leaves the company, all of this access should be revoked immediately. In practice, this often only happens partially. The email account gets deleted, but access to the accounting software remains active. This exact remainder is what’s called Residual Access: access that keeps working even though nobody needs it or is allowed to have it anymore. The same applies to software from third-party companies that can still peek into the database long after the project has ended.

The Forgotten Back Door as a Security Risk

An active access point that nobody is watching anymore is especially attractive to attackers. If an employee logs in daily, a foreign login from another country quickly stands out. But with an account that has been dead for two years, nobody is looking. Attackers can move around there for weeks without being detected. Studies on data breaches regularly cite outdated or orphaned accounts as one of the most common causes.

On top of that, there’s a legal problem. The European General Data Protection Regulation requires companies to be able to prove who is allowed to access personal data. A forgotten access point belonging to a former service provider constitutes a violation in this sense. If a data breach occurs, fines are a real risk. Regulatory authorities then ask very precisely who had which rights and when.

For investors, this is therefore not a purely technical IT detail. During company acquisitions, buyers now routinely check whether the acquired company has its access rights under control. An overgrowth of old accounts lowers the purchase price or leads to renegotiations.

How Old Access Points Arise and Disappear Again

Residual Access almost never arises intentionally. The most common reason is simple lack of oversight. A mid-sized company often uses several hundred different programs and cloud services. Each one maintains its own user list. When someone resigns, they are removed from the HR department’s records, but this information doesn’t reach every single system.

A second source is technical access points without a human owner. Programs access each other via so-called API keys, i.e., long strings of characters that serve as passwords for machines. Such keys are created for a project and then never revoked. They then sit in some configuration file for years and keep working.

The countermeasure is called Identity and Access Management, or IAM for short. Behind this is a central system that manages all access in one place. When HR reports a departure, the system automatically locks all linked accounts. In addition, there are regular reviews in which department heads must confirm lists of their employees and their rights. Anything nobody confirms gets deleted. Another principle is granting time-limited rights: access automatically expires after 90 days instead of remaining valid forever.

From AI Training Data to Your Own Phone

The term usually shows up in the news after a data breach. When it’s reported that attackers got in through the access of a former service provider, that’s Residual Access. It also plays a role in disputes over AI models. A company terminates a data contract, but the AI provider can technically still access the data. Lawyers then argue over whether already-trained models must be deleted.

The principle also applies on a small scale. Anyone who has ever connected an app with their Google or Instagram account has given it access. Deleting the app from your phone often leaves this connection intact. In the account settings, you can check which services still have access. For most people, apps they haven’t used in years are listed there.

A common misconception is that Residual Access is the same as a back door. A back door is intentionally built in to allow secret entry. Residual Access, by contrast, is a leftover from a time when the access was entirely legitimate. It’s dangerous nonetheless, because it works just as well.