Retention rate is the percentage of customers, users, or assets that remain active over a defined period. In identity and security programs, it can measure how many accounts, subscriptions, or managed identities continue in use, helping assess adoption, control stickiness, and the stability of the identity estate over time.
What Retention Rate Tells You
Retention rate is not just a business metric, it is a stability signal. In security and identity programmes, it shows whether users, customers, or managed assets continue to be active over time, which helps distinguish durable adoption from temporary use.
Because the term is defined as a percentage over a period, the most important detail is the measurement window and population. A retention rate for customer subscriptions, workforce accounts, or managed identities can each be valid, but they answer different operational questions.
Why Retention Rate Matters in Security Programs
In identity-heavy environments, retention rate can reveal whether controls are becoming embedded in day-to-day operations or fading after rollout. A rising rate may indicate that accounts, subscriptions, or identities are actually being used, while a falling rate can point to unused estates, weak adoption, or turnover that should be reflected in governance and inventory.
It is also a useful lens for lifecycle discipline. Retained assets are easier to monitor, support, and govern than dormant ones that linger without ownership. When the rate is tracked consistently, it can help teams spot whether the identity estate is becoming more stable or more fragmented.
How to Interpret Retention Rate Correctly
Retention rate only becomes meaningful when the denominator is clear. You need to know whether the measure includes all registered accounts, only active users, only managed identities, or only assets that were in scope at the start of the period.
It also needs context from adjacent metrics. A high retention rate can be positive, but it can also hide over-retention, such as stale accounts that remain enabled because nothing ever churns. A low retention rate can signal poor adoption, but it can also reflect healthy cleanup, deprovisioning, or portfolio reduction.
For this reason, retention rate should be read alongside recency, activity, and lifecycle status rather than treated as a stand-alone success metric.
Common Uses and Limits of the Metric
Retention rate is most useful when the goal is to understand persistence, continuity, or stickiness over time. In security operations, that often means asking whether identity-related assets remain in use long enough to justify their existence and ongoing control costs.
Its limitation is that it measures continuity, not quality. A retained account is not necessarily well governed, and a retained asset is not necessarily secure. The metric tells you who or what stayed, not whether it stayed in the right state.
When used carefully, retention rate becomes a practical indicator of programme stability, adoption durability, and estate hygiene, but only if the underlying population and time period are defined with precision.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Asset Inventory | Retention rate depends on knowing which users, accounts, or assets remain in scope over time. |
| GV.RM-01 — Risk Management Strategy | Retention rate can be used as an operating signal for stability and lifecycle risk in the identity estate. | |
| Recommendation — Maintain an accurate inventory of in-scope accounts and assets so retention measurements reflect the real estate. Use retention metrics as part of your recurring risk review for identity and asset lifecycle stability. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Retention trends become meaningful when activity and lifecycle evidence are reviewed over time. |
| Recommendation — Review historical activity and lifecycle evidence to validate whether retained items are actually active and governed. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | Retention rate is only interpretable when the tracked population is defined and maintained as an asset inventory. |
| Recommendation — Keep the asset and account inventory current so retention analysis is based on a defined population. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Retention rate for assets relies on the enterprise knowing what still exists and remains active. |
| Recommendation — Track enterprise assets consistently so retention reporting can distinguish active assets from stale ones. | ||
Related resources from NHI Mgmt Group
- What is the difference between retention rate and engagement depth in AI products?
- What is the difference between data retention risk and integration risk in AI tools?
- When should organisations treat retention as a security control rather than a records task?
- What should teams do when rate limits are exceeded?