What is ghost access?
Ghost access is a live grant on an account held by someone who should no longer have it — a former employee, a finished agency, a contractor whose engagement ended.
It is not a breach and nothing has gone wrong yet, which is exactly why it persists. The access works, nobody is using it visibly, and no alert fires. It surfaces during an audit, during an incident, or when the holder decides to use it.
Agency seats are the largest source. A partner organisation granted access to a business manager keeps that grant until someone revokes it, and the contract ending does not revoke anything.
Finding it requires comparing two lists that usually live in different places: who currently holds access on each platform, and who the business currently employs or contracts.
Related terms
- Joiner-mover-leaverJoiner-mover-leaver is the access control process covering the three points at which a person's access should change — when they join, when they change role, and when they leave.
- SCIMSCIM is the open standard that lets an identity provider push user accounts and group membership into another system automatically, so joiners and leavers propagate without anyone doing it by hand.
- Business managerA business manager is the platform-side container that owns a brand's accounts, pages and ad assets and controls which people and partner organisations can access them.
- Account takeoverAccount takeover is an attacker gaining control of a legitimate account, and on corporate social accounts it almost always happens through people and process rather than through the platform itself.