While on a penetration test of a mid sized company (100 to 1000 employees) discovered that some admins had created a back door account and vpn access.
Pulled the logs and it was in use. They just fired an admin and they knew of the back door to create havoc. Turns out that after talking with various Managers, there seemed to be the same problems popping up after each admin was let go. Hmmmmm.
While technically, this is not funny nor humorous, it showed that the Admins, even the new ones kept the backdoor open. Insider threat come to mind ?