It Usually Starts With A Reasonable Decision

An employee leaves the company. Or they shift from full-time employee to contractor. Or leadership decides to be generous and lets them buy their laptop. The computer goes with them.

There’s no incident. No urgency. Often no ticket. Sometimes IT isn’t even informed. And that’s exactly where the risk begins.

The Most Dangerous Device Is The One That Used To Be Yours

In many organizations, the highest-risk computer isn’t an unmanaged personal device or a forgotten server. It’s the laptop that used to be company-owned and quietly became personal.

Everything that made it a company computer doesn’t disappear when ownership changes. Company data doesn’t vanish. Licensed software doesn’t remove itself. Security and management tools don’t politely uninstall. And responsibility doesn’t evaporate just because intent has changed.

What does disappear is clarity.

Ownership Changes Faster Than Reality

From a business perspective, it’s natural to think in terms of intent. The employee is gone. Accounts have been disabled. There’s trust that nothing inappropriate will happen.

From a technical and legal perspective, none of that changes what actually exists on the device. Cached credentials remain. Files sync offline. Browser sessions persist. Security and management tooling may still be present.

Disabling accounts is necessary. It is not sufficient.

Why This Happens So Often

These transitions are rarely malicious. They usually happen under time pressure and with good intentions. Offboarding needs to move quickly. Leadership wants to be fair. No one wants to introduce friction during an already awkward transition.

Once the device leaves company control, the assumptions behind those decisions stop being enforceable.

The Quiet Accumulation of Risk

Nothing bad happens immediately. Weeks pass. Months pass. Sometimes years pass.

Until a security incident occurs. A vendor audits licensing. A legal dispute triggers discovery. Or an insurance claim is scrutinized.

At that point, intent matters far less than artifacts.

The Takeaway

When a company computer quietly becomes personal, responsibility doesn’t disappear. It drifts.

In the next post, we’ll look at why the most common response — partial cleanup — doesn’t reduce that risk, but leaves behind something much worse.