Bad sign-ups expose the governance gap in SaaS identity

At a glance

What this is: This is an analysis of how low-quality sign-ups distort SaaS growth, operational cost, and compliance posture when identity quality is not enforced at registration.

Why it matters: It matters to IAM practitioners because the same identity governance blind spots that let fake human accounts through also shape how teams think about access quality, fraud controls, and lifecycle enforcement across NHI, autonomous, and human identity programmes.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read WorkOS's article on stopping bad sign-ups and fake account abuse

Context

Sign-up abuse is a governance problem before it is a growth problem. Disposable emails, bots, and repeat trial accounts create identities that look real to product metrics but carry little or no trust, which means access, analytics, billing, and compliance all start from a distorted baseline.

For IAM teams, the lesson is familiar even when the subject is customer sign-up rather than internal access. If identity proofing and abuse controls are weak at the front door, every downstream decision inherits that weakness, from trial entitlements to fraud review to regulatory exposure.

Key questions

Q: How should security teams stop disposable-email abuse at sign-up?

A: Security teams should block temporary email domains before account creation and pair that filter with additional trust signals such as IP reputation, device patterning, and rate limits. The goal is not to prove identity with one check, but to remove the easiest path to low-cost abuse before it pollutes product and compliance data.

Q: Why do fake accounts create an IAM problem, not just a growth problem?

A: Fake accounts create an IAM problem because they distort the organisation’s trust model. Once untrusted identities enter the system, analytics, access decisions, support workflows, and compliance reporting all depend on data that looks valid but is not. That turns identity quality into a governance issue, not just a marketing metric.

Q: What do teams get wrong about CAPTCHA and bot detection?

A: Teams often assume one challenge response is enough to separate humans from automation, but modern abuse uses browser simulation, distributed requests, and repeated retries. Effective control relies on layered signals, especially velocity and behavioural correlation, rather than a single gate that attackers can work around.

Q: Who is accountable when a sign-up flow accepts sanctioned-region accounts?

A: Accountability usually sits with the product, security, and compliance functions that own the onboarding decision path. If sanctions screening happens after account creation, the business has already accepted risk. Governance should define who can approve exceptions, who monitors policy changes, and who is responsible for blocking activation when conditions fail.

Technical breakdown

Disposable email detection and identity proofing at sign-up

Disposable email blocking is a lightweight form of identity proofing. It compares the email domain against a curated and continuously updated list of temporary providers, then rejects addresses that are likely to disappear after registration. On its own, that does not prove the user is legitimate, but it removes a common path for trial abuse and metric inflation. In practice, this is a first-line control for account quality, not a complete fraud strategy. Its value depends on update frequency, false-positive handling, and whether the registration flow treats the email address as a meaningful trust signal or just a field to collect.

Practical implication: treat disposable-email blocking as an entry control that reduces low-effort abuse before account creation, not as a standalone trust decision.

Bot detection, velocity signals, and repeated free-trial abuse

Bot detection at sign-up uses behavioural and network signals such as request rate, headers, device patterns, and interaction timing to separate human traffic from automation. Unlike simple CAPTCHA checks, this works by correlating patterns across many requests rather than asking one client to prove it is human once. Repeated free-trial abuse is often a coordination problem, not a single malicious event. Attackers rotate addresses, IPs, and devices to create the appearance of distinct users. That is why velocity and fingerprinting matter together: one captures scale, the other links reuse across supposedly separate accounts.

Practical implication: combine velocity thresholds with device and network correlation so recurring abuse cannot simply rotate through new emails.

Sanctions screening and compliance controls in customer onboarding

Sanctions screening at sign-up is a compliance gate, not just a fraud filter. It checks whether a new account originates from a restricted geography or matches a sanctioned-party condition that should block onboarding. The control matters because sign-up systems often sit at the boundary between marketing, product, and legal obligations, where manual review is too slow to be reliable. If screening is done after account creation, the organisation has already accepted risk and may have to unwind access, billing, and records later. The technical challenge is keeping the policy current and ensuring it is enforced before entitlement is granted.

Practical implication: enforce sanctions and geography checks before account activation so compliance risk is stopped at registration, not remediated after the fact.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Low-quality sign-up data is a governance failure, not a growth metric problem. When disposable emails and repeat trials enter the funnel, the organisation creates identities it cannot trust from the outset. That breaks the assumption that a registered user represents a real, accountable customer, and it contaminates every downstream control that depends on that assumption. The implication is that identity quality must be treated as a control plane, not a marketing afterthought.

Identity quality debt is the hidden operational cost of unchecked registration flows. Fake accounts do not just distort dashboards. They consume engineering cycles, pollute support queues, and force product teams to defend decisions made on unreliable data. That cost compounds because the more polluted the base identity layer becomes, the harder it is to distinguish abuse from legitimate low-activity behaviour. Practitioners should read this as a lifecycle problem that starts before access is granted.

Sanctions exposure at sign-up shows that onboarding is now a compliance boundary. A registration flow is no longer a neutral data collection step when geography and account provenance can create legal exposure. That is especially relevant in SaaS environments where product-led growth blurs the line between marketing automation and entitlement issuance. The practical conclusion is that onboarding policy must be enforced as a governed decision point, not a post-hoc review.

Layered abuse controls map directly to the principle of defense in depth for identity. One control will not separate humans, bots, and fraudulent repeat users at scale. Multiple signals, each with a different failure mode, reduce the chance that a single bypass technique can pollute the environment. For IAM and identity architects, that means the registration journey should be modelled as an access pipeline with discrete checkpoints and explicit trust decisions.

Named concept: identity quality debt. This is the accumulation of untrusted, low-value, or fraudulent accounts that make every later identity decision more expensive and less reliable. Once that debt exists, access review, analytics, and compliance all have to work around bad upstream data instead of governing clean identities. The implication is that preventing bad accounts early is materially cheaper than trying to cleanse them later.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
• That same control gap is why teams should revisit the Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs when they are tightening onboarding and offboarding governance.

What this signals

Identity quality debt: when organisations let disposable emails and repeat trial abuse into the funnel, they accumulate untrusted accounts that make every later governance decision more expensive. That is the same structural problem IAM teams face when access is granted before identity confidence is established.

With more than 1 in 5 non-human identities believed to be insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities, the wider lesson is that identity systems fail when they optimise volume before trust. Product teams should watch the same pattern in customer onboarding, machine access, and automated account creation.

As organisations tighten onboarding controls, the next maturity step is to treat registration as a governed lifecycle event. The NIST Cybersecurity Framework 2.0 is a useful anchor for aligning govern, protect, and respond functions around account quality rather than raw sign-up count.

For practitioners

• Move trust checks into registration, not cleanup Enforce disposable-email screening, sanctions checks, and basic fraud signals before the account is activated. If identity quality is only reviewed after signup, the organisation has already accepted polluted metrics and avoidable compliance exposure.
• Correlate repeated trial abuse across identities Use device fingerprinting, request velocity, and reused network patterns together so the same actor cannot simply rotate emails or IPs. The goal is to detect coordination, not just individual bad records.
• Treat sign-up controls as part of the access lifecycle Connect onboarding checks to entitlement issuance, billing, and offboarding so fraudulent or restricted accounts cannot persist unnoticed. That creates a cleaner lifecycle boundary and reduces downstream cleanup work.
• Review false positives with business context Tune blocking rules so disposable-email and geography controls do not punish legitimate users in privacy-sensitive or high-churn segments. Track rejected sign-ups, manual overrides, and subsequent abuse rates together.

Key takeaways

• Bad sign-ups are a trust and governance problem because they create identities that look real while corrupting analytics, compliance, and operations.
• The scale of NHI insecurity shows why identity quality cannot be treated as a secondary control, with more than 1 in 5 NHIs believed to be insufficiently secured.
• The practical fix is layered registration governance that blocks abuse before activation and ties onboarding decisions to lifecycle and compliance controls.

Key terms

• Identity Quality Debt: The accumulation of low-trust, fraudulent, or disposable identities that makes later governance decisions more expensive and less reliable. It is not just bad data. It is a structural weakness that degrades analytics, compliance, entitlement decisions, and remediation effort across the identity lifecycle.
• Disposable Email Control: A registration control that blocks temporary email domains used to create throwaway accounts. It reduces low-effort abuse at the front door, but it does not prove legitimacy on its own. In practice, it works best as one signal in a layered onboarding trust model.
• Repeat Trial Abuse: A pattern where the same actor creates multiple accounts to avoid payment, exploit free-tier limits, or distort usage metrics. The behaviour often involves rotating emails, devices, and network paths, which means effective detection depends on correlation rather than a single identifier.
• Sanctions Screening At Onboarding: A compliance check that evaluates whether a new account should be blocked before activation because of geography, sanctions status, or other restricted conditions. It is a governed onboarding decision, not a post-creation cleanup task, and it should be enforced before entitlement is issued.

Deepen your knowledge

Identity quality, lifecycle enforcement, and access governance all converge in the NHI Foundation Level course, the industry's only accredited NHI security programme. If your team is working to stop bad sign-ups from becoming bad identities, this is a useful place to start.

This post draws on content published by WorkOS: The hidden cost of bad sign-ups and how to stop them. Read the original.