Zombie SaaS describes inactive or abandoned SaaS accounts that still retain company data or access rights. These accounts are risky because they often remain forgotten after a project ends, creating unnecessary exposure and making offboarding, access review, and compliance harder to manage.
Expanded Definition
Zombie SaaS refers to SaaS accounts that remain active after the business need has ended, even though no one is using them day to day. In NHI security, the risk is not the name of the application itself but the persistence of access rights, tokens, stored data, and linked workflows that continue to operate without an accountable owner.
Definitions vary across vendors, but the practical distinction is simple: a dormant account becomes a security problem when it can still authenticate, access data, or call integrated services. This is why zombie SaaS is often managed alongside offboarding, entitlement review, and secrets governance rather than as a pure application inventory issue. The concept aligns closely with the access review and least-privilege principles reflected in the NIST Cybersecurity Framework 2.0.
The most common misapplication is treating a decommissioned user profile as harmless when the account still has API tokens, delegated admin roles, or retained file access after the project ends.
Examples and Use Cases
Implementing zombie SaaS detection rigorously often introduces a governance burden, requiring organisations to balance continuous visibility against the time spent tracing ownership, usage, and downstream integrations.
- A contractor leaves, but the project workspace in a collaboration platform remains open and still contains regulated documents.
- A marketing automation account is no longer used by staff, yet its OAuth grant still syncs customer records into a CRM integration.
- A proof-of-concept SaaS trial becomes a shadow production tool after launch, and the original admin never revokes the account.
- An acquired company keeps legacy SaaS tenants alive for a transition period, but no one performs a full entitlement cleanup before the contract renews.
- A departed engineer’s account still owns webhook secrets and CI/CD connections, creating a lingering path into internal systems, similar to patterns seen in the Salesloft OAuth token breach.
These cases are easier to detect when organisations correlate user lifecycle events with application logs, token inventories, and SaaS admin reports. For lifecycle discipline and offboarding patterns, see Ultimate Guide to NHIs and the NIST guidance on access governance.
Why It Matters in NHI Security
Zombie SaaS is an NHI issue because the account often carries non-human access pathways such as service tokens, delegated permissions, automation rules, and embedded secrets. If those credentials are not revoked, the account can remain a quiet foothold long after the original owner has left. NHIMG research shows that only 20% of organisations have formal processes for offboarding and revoking API keys, which helps explain why dormant access persists in real environments.
The security impact extends beyond simple sprawl. Forgotten SaaS accounts can bypass normal review cycles, retain excessive privileges, and obscure data residency or retention obligations. That is why the Ultimate Guide to NHIs treats lifecycle control, rotation, and visibility as core governance requirements, not optional hygiene. The same risk pattern appears in incidents such as the BeyondTrust API key breach, where unmanaged access can become operationally significant.
Organisations typically encounter this problem after a compromise investigation, audit finding, or customer access dispute, at which point zombie SaaS becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207), NIST SP 800-63 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers lifecycle and ownership gaps that create dormant NHI-like SaaS access. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access reviews directly address stale SaaS entitlements. |
| NIST Zero Trust (SP 800-207) | N/A | Zero Trust requires continuous verification rather than assuming dormant accounts are safe. |
| NIST SP 800-63 | IAL/AAL guidance | Identity assurance concepts support revoking stale accounts tied to outdated identity proofing. |
| NIST AI RMF | Governance and monitoring help manage lifecycle risk from unattended digital access. |
Review SaaS access regularly and remove credentials, roles, and integrations that no longer have a business need.
