Dormant account detection is the process of identifying identities that have not been used for a period of time or appear orphaned from an owner or business purpose. These accounts can become easy targets for misuse. The control helps teams reduce standing exposure and clean up identity sprawl before it becomes an attack path.
Expanded Definition
dormant account detection is the practice of finding identities that have stopped performing expected work, lost their operational owner, or no longer match a current business function. In NHI security, the term applies to service account, API keys, workload identities, and other machine identities that remain present in infrastructure even after the system, integration, or team that depended on them has changed. Definitions vary across vendors on how long an account must be inactive before it is “dormant,” so the more useful test is whether the account still has a valid purpose, a known owner, and a current access path. NIST guidance on access control and account lifecycle management is relevant here, especially when organisations are trying to reconcile identity inventory with actual use. NHI management also depends on lifecycle discipline, which is why the NHI Lifecycle Management Guide and NIST Cybersecurity Framework 2.0 are useful reference points for governance and continuous monitoring.
The most common misapplication is treating “unused recently” as the same as “safe to ignore,” which occurs when teams rely on login timestamps without checking ownership, entitlements, or downstream trust relationships.
Examples and Use Cases
Implementing dormant account detection rigorously often introduces inventory and ownership-reconciliation overhead, requiring organisations to weigh reduced attack surface against the effort of tracing each identity back to a business purpose.
- A legacy CI/CD service account has not authenticated in 90 days, but still holds production secrets, so the team verifies whether the pipeline was retired or simply migrated.
- An API key tied to a third-party integration appears inactive in logs, prompting review of whether the partner has quietly failed over to a new credential.
- A workload identity remains in a cloud project after an application decommission, and detection rules flag it for owner confirmation and removal.
- Security teams use patterns from the Top 10 NHI Issues to distinguish true dormancy from low-frequency but still valid automation.
- Account review workflows map inactivity signals against NIST SP 800-53 Rev 5 Security and Privacy Controls to support periodic access reassessment and account lifecycle controls.
Why It Matters in NHI Security
Dormant identities are dangerous because they often retain privileges, trust paths, and embedded secrets long after active monitoring has moved elsewhere. That makes them attractive for lateral movement, persistence, and stealthy re-entry. NHI Management Group research shows that only 5.7% of organisations have full visibility into their service accounts, which means many dormant identities are effectively invisible until they are abused. The risk is not just leftover accounts, but leftover authority: a dormant account with broad entitlements can become a privileged foothold if its credentials are still valid or recoverable. This is why dormant account detection belongs alongside rotation, offboarding, and secret hygiene in a broader lifecycle program, as discussed in the Ultimate Guide to NHIs — Key Challenges and Risks and reflected in the visibility expectations of NIST Cybersecurity Framework 2.0.
Organisations typically encounter dormant-account risk only after an unexpected incident review exposes an old identity still able to authenticate, at which point dormant account detection becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Dormant identities are a core NHI lifecycle and inventory risk. |
| NIST CSF 2.0 | ID.AM-1 | Asset and identity inventory supports finding unused accounts. |
| NIST SP 800-63 | IAL | Identity assurance depends on knowing which accounts remain valid and active. |
| NIST Zero Trust (SP 800-207) | PL-2 | Zero Trust assumes identities must be continuously evaluated, including inactive ones. |
| NIST AI RMF | AI systems need governance over stale or abandoned machine identities. |
Continuously inventory NHIs, flag inactive accounts, and revoke or retire those with no current owner or purpose.
