Thankfully, nothing like that has happened here, but we have a break glass account that only 2 people know of, and it’s locked in a safe. Also, my place has gotten so good at firing people they know how and when to do it to minimize risk. Like end of day when they are all packed up, and if its a really high up person, top admins are contacted prior and held on standby to disable everything as soon as the word is given. This includes admins. If they are remote, they will normally lock them out of the laptop first and make sure access is gone before letting them know.
Thankfully, nothing like that has happened here, but we have a break glass account that only 2 people know of, and it’s locked in a safe. Also, my place has gotten so good at firing people they know how and when to do it to minimize risk. Like end of day when they are all packed up, and if its a really high up person, top admins are contacted prior and held on standby to disable everything as soon as the word is given. This includes admins. If they are remote, they will normally lock them out of the laptop first and make sure access is gone before letting them know.