Hardware Lifecycle: The Device Category We Kept Losing Track Of

Contractor laptop asset tracking fails at offboarding because contractors are managed across three separate systems — HR, the contracting agency, and IT — that do not share a workflow trigger. Without a discovery-backed verification step at offboarding, devices can remain active on the corporate network for months after a contract ends, with valid VPN credentials and access to internal file shares.

The scenario below, drawn from patterns across enterprise IT environments, shows how this gap compounds in practice. In a typical mid-market estate managing 400+ contractor laptops: permanent employees return hardware at offboarding 97% of the time. Office-based contractors return at 94%. Remote, project-based contractors — the devices furthest from IT’s direct visibility — return at just 66%. The other third disappears into the gap between IT, HR, and the contracting agencies that none of them fully owns.

Why contractor laptops were different

This is not about the full device lifecycle — it is about the offboarding phase, the point where most contractor devices disappear.

The problem with contractor hardware was not unique to any one system. It was a consequence of how contractors were managed across systems that did not communicate with each other.

When a permanent employee was offboarded, HR triggered a workflow that included a mandatory device return step. The device was logged back into the ITAM system by the IT support desk, which issued a return receipt.

When a contractor’s engagement ended, the contracting agency notified the business unit. The business unit notified HR. HR sent the contractor a return shipping label. Nobody notified IT until the laptop either arrived in the receiving queue or did not. Most went unrecovered — only two of every three devices returned.

Contractor device management fell outside any single team’s ownership. Our IT asset management system showed 412 laptops assigned to contractors across our estate at any given time. Our actual loss rate for that category, calculated over an 18-month audit, was 34%. That meant 140 laptops had been written off or gone unrecovered over the preceding three fiscal years. At an average replacement cost of $1,400 per device, that was $196,000 in hardware we could not account for.

In brief: why contractor devices have higher loss rates than employee devices

Contractor device returns depend on notification chains between HR, business units, and contracting agencies that frequently exclude IT. Without a discovery-backed verification step at offboarding, devices are never flagged as unreturned. Contractors typically assume someone will contact them about return logistics — without a formal return trigger tied to offboarding, many keep the device.

What discovery found after offboarding

The loss rate alone was the visible problem. What IT discovery uncovered was the security problem underneath it.

During a quarterly network scan, discovery identified 47 devices that appeared in our active device inventory with contractor names attached to users who had been formally offboarded. These devices were authenticating to the network. In 31 cases, the offboarding record in HR showed a completion date more than 90 days prior. Eleven had been written off as lost more than a year earlier. Their VPN credentials were still active — and the devices were still connecting to the corporate network.

The discovery result triggered an immediate security response. We revoked VPN access for all 47 accounts within 4 hours. Eight of the devices were subsequently returned by contractors who had kept them after engagement end, apparently unaware of the return requirement. Eleven were recovered from contracting agencies that had reassigned them without notifying us. Twenty-eight were unrecoverable. Of those 28, the network activity logs showed continued access to internal file shares for periods ranging from 6 to 14 months post-offboarding.

The hardware loss was expensive. The unauthorized network access was worse.

In brief: the security risk from unreturned contractor devices still on the network

Unreturned contractor laptops that retain active VPN credentials continue authenticating to the corporate network after offboarding. Without credential-to-device linkage in ITAM, IT teams have no automated alert when an offboarded user’s device is still accessing internal file shares. In documented cases, unauthorized access continued for 6 to 14 months post-offboarding before network discovery scans surfaced the active sessions.

Where the ITAM process broke down

The root cause was not contractor behavior — most contractors assumed someone would contact them if it mattered. Our ITAM process had no visibility into whether a device assigned to a contractor was still active on the network after the offboarding date.

Our CMDB recorded device assignment by employee ID. When the contractor record was closed in HR, nothing triggered an ITAM check on the associated devices. The lifecycle state of the device (assigned, in transit, recovered, decommissioned) depended entirely on whether IT received a physical return or a written notice of return.

Three specific gaps drove the problem:

No discovery-to-offboarding trigger

There was no process that ran a network presence check on contractor-assigned devices when an offboarding event fired. Discovery found them 90+ days later during a routine scan.

No credential-to-device linkage in ITAM

The 47 devices that were authenticating post-offboarding had active VPN credentials. ITAM tracked device assignments. Identity management tracked credentials. The two systems did not talk to each other.

No category-level loss reporting

Our ITAM reporting looked at overall hardware loss rates without segmenting by device category. The contractor laptop problem had been hidden inside an acceptable overall number for three years.

Industry data reflects how common this gap is. A 2025 Teqtivity study found that 71% of HR professionals report departing employees do not return company-owned equipment. For remote contractors specifically, the loss rate is compounded by the agency notification layer — the fragmented chain between HR, business units, and agencies adds a step that permanent employee offboarding does not have.

Organizations that segment hardware lifecycle metrics by device category and user type identify asset loss risks that aggregate inventory numbers consistently obscure. The contractor laptop category surfaces first most often, because it carries the most decentralized offboarding responsibility.

Building a discovery-backed return process

After the security remediation, we redesigned the contractor offboarding process around discovery data as the verification layer.

The new process works as follows. When HR closes a contractor record, an automated ticket opens in ITSM requesting IT to run a network presence check on all devices assigned to that contractor. Discovery confirms whether the device is still active on the network. If it is, credential revocation is completed within 24 hours and a return shipping request is sent directly to the contractor and their agency. The ITAM record updates to reflect the new status.

We connected the contractor offboarding workflow in ServiceNow to device assignment records in ITAM — an HRIS-to-ITSM offboarding trigger with discovery verification that closed the gap between HR, IT, and the contracting agencies.

Results: contractor recovery rate after 12 months

In the 12 months following that implementation, our contractor laptop recovery rate improved from 66% to 91%. Devices that were not returned within 14 days of offboarding were flagged for agency escalation, with a formal cost recovery process for unrecovered hardware. Two contracting agencies were removed from our preferred vendor list after failing to meet the return SLA three times.

If your ITAM process has no discovery-backed offboarding check for contractor devices, this gap is likely costing you hardware and creating credential risk. Schedule a demo to see how Virima connects discovery to ITAM lifecycle events.

In brief: how IT discovery improves contractor device recovery at offboarding

IT discovery improves contractor device recovery by running a network presence check on all devices assigned to a contractor at the moment an offboarding event fires in HR. If the device is still authenticating to the network past the offboarding date, discovery triggers credential revocation and a return request — closing the gap between HR records and ITAM lifecycle status.

What category-level analysis changed

The contractor laptop investigation prompted us to segment our full ITAM inventory by device category and run loss rate analysis across each one. We found two other categories with elevated loss rates that had been invisible inside the aggregate number:

• Spare laptops in manager pools: 22% loss rate, primarily from informal lateral assignments not recorded in ITAM
• Peripherals assigned at employee home offices: 41% loss rate at offboarding, with most peripherals neither returned nor formally written off

Neither category had a discovery-backed return process. Both now do.

For ITAM teams that report on overall hardware loss rates without category segmentation, breaking the number down by device type and user category surfaces hidden loss patterns that aggregate loss rates obscure. The categories with the highest rates are almost always the ones with the least structured lifecycle process — and they are rarely visible in aggregate numbers.

Category-level ITAM asset recovery: making it the standard

The contractor laptop problem did not appear in any of our standard ITAM reports. It appeared when we started segmenting by category and running discovery-backed verification against our offboarding records. The gap between what ITAM recorded and what discovery found was the measure of our actual lifecycle control.

ITAM asset recovery rates improve when discovery verification is part of the offboarding trigger — not a quarterly scan that catches the gap 90 days later. For teams managing mixed employee and contractor estates, CMDB best practices for hardware lifecycle now need to include category-level loss rate tracking and discovery-verified offboarding checks.

Virima’s discovery engine gives IT teams a real-time answer to “is this device still on the network?” — turning category-level loss reporting from a lagging indicator into a live control. Schedule a demo to see how discovery-backed contractor offboarding can improve your hardware recovery rate.

Frequently Asked Questions