TL;DR: 90% of organisations assessed had enabled inactive user accounts and 90% had accounts with passwords that never expire, while thousands of dormant and stale identities remained active across environments, according to Lepide research. Identity lifecycle processes assume access is cleaned up as roles change, but unmanaged persistence turns dormant accounts into a standing attack surface.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Lepide's report: Identity lifecycle weaknesses were widespread, with inactive accounts and non-expiring passwords showing persistent governance drift across environments.
Why it matters: This matters because stale identities and unmanaged credentials expand attack surface, complicate audits, and weaken confidence in least privilege across NHI, autonomous, and human identity programmes.
By the numbers:
- 90% of organisations assessed had enabled inactive user accounts.
- 90% of organisations had accounts configured with Password Never Expires.
- More than 5,900 inactive accounts were identified across the environments reviewed.
Context
Identity lifecycle management fails when onboarding, role changes, and offboarding do not keep pace with the way access actually accumulates. In practice, accounts stay enabled long after they should have been retired, and stale credentials remain valid because no one owns the cleanup cycle.
Lifecycle management is the control discipline that should remove access when business need ends, but many environments still treat it as a periodic clean-up rather than a continuous governance process. That gap leaves dormant identities, unused permissions, and stale secrets available long after they should have disappeared.
The result is not only more accounts, but less confidence in who should still have access. Lepide's research points to a typical enterprise pattern rather than an edge case, where lifecycle controls lag the speed of organisational change.
Key questions
Q: How do you find dormant accounts before they become an access risk?
A: Start by defining inactivity thresholds that fit the business, then look for enabled accounts that have not authenticated within those windows. Prioritise accounts with administrative privileges, access to sensitive data, or no clear owner. The goal is not just discovery but fast disablement or reauthorisation before the account remains available to attackers or audit reviewers.
Q: Why do non-expiring passwords create persistent security risk?
A: A password that never expires creates persistent risk because any theft, reuse, or shared use remains valid until the credential is changed or revoked. For service accounts and other NHI, it also defeats rotation controls, lets old secrets survive role changes and offboarding, and gives attackers a longer window to use cached credentials, especially where no MFA or PAM checkpoint exists.
Q: What is the difference between access reviews and lifecycle governance?
A: Access reviews are periodic checks that confirm whether existing permissions should remain in place. Lifecycle governance is broader because it controls access at join, move, and leave events, then keeps ownership, expiry, and revocation aligned over time. In practice, organisations need both, but lifecycle controls reduce the volume of review findings.
Q: When should teams retire privileged service accounts?
A: Teams should retire privileged service accounts when the workload, integration, or owning team is decommissioned, and also when the account can be replaced by a scoped service identity or workload identity. Privileged service accounts should never remain in place after their administrative function ends, because they often carry standing access, stored secrets, and broad reach across systems.
Technical breakdown
Why inactive accounts persist after role changes
Inactive accounts usually persist because identity processes are fragmented across HR, IT, and application owners. When joiner, mover, and leaver events are not tied to a single authoritative workflow, old access remains live after a person changes role or leaves. Dormant accounts are especially dangerous because they look legitimate in logs and access reviews, yet they no longer have a business owner actively watching them. Over time, this creates a backlog of enabled identities that still authenticate successfully but no longer have a clear operational purpose. See the Joiner-Mover-Leaver (JML) Guide.
Practical implication: Tie account status to authoritative lifecycle events so stale identities are disabled when business need ends.
Why Password Never Expires creates long-lived credential risk
A non-expiring password is a standing credential with no built-in expiry pressure. That means compromise windows stay open indefinitely unless a separate process forces rotation or revocation. This is particularly risky for standard users, shared accounts, and service accounts because long-lived passwords are hard to distinguish from legitimate activity until abuse is well underway. In mature identity programmes, password lifetime is not just a user convenience setting. It is a control boundary that should reflect the risk profile of the identity and the business process behind it.
Practical implication: Treat non-expiring credentials as exceptions that require explicit ownership, justification, and periodic review.
How identity sprawl weakens access reviews
Access reviews lose precision when the underlying identity population is already cluttered with dormant accounts and stale access. Reviewers then spend time validating identities that should have been removed earlier, which reduces trust in certification outcomes and increases audit effort. The problem is not just volume. It is the mismatch between periodic review cadences and identity states that should have changed earlier in the lifecycle. Once that mismatch becomes normal, the organisation starts certifying noise instead of meaningful access.
Practical implication: Reduce review burden by removing dead accounts before certification cycles begin.
Threat narrative
Attacker objective: Use a forgotten but still-valid identity to gain durable access to systems and data that the organisation assumes are no longer reachable.
- Entry occurs through an enabled inactive account that still accepts authentication even though the original user need has ended.
- Escalation becomes possible when that account also carries a non-expiring password or inherited access that was never removed.
- Impact follows when the stale identity is used to reach corporate resources, sensitive data, or privileged administration paths without immediate detection.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
- Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Dormant access is a lifecycle failure, not a housekeeping issue. Lepide's research shows that inactive accounts and non-expiring passwords accumulate when joiner, mover, and leaver processes lose pace with the business. The security problem is not the presence of one bad account, but the normalisation of identities that outlive their business purpose. That makes lifecycle governance a live attack-surface control, not an administrative chore.
Long-lived credentials create invisible exposure windows. Passwords that never expire, especially on service and shared accounts, extend the useful life of a compromise far beyond what most review cycles can observe. The organisation may believe it is reviewing access regularly, but the credential itself remains valid between reviews. The implication is that duration of validity becomes a first-class security variable, not a back-office setting.
Identity hygiene now defines whether zero trust is credible. Zero Trust assumes that access is continuously evaluated, but that assumption breaks down when stale identities remain enabled and trusted by default. If an environment cannot retire old accounts and credentials promptly, it cannot claim to know who is entitled to what at any moment. The result is a governance gap that weakens both trust decisions and incident response.
Legacy lifecycle control is the named concept this research makes unavoidable. By showing how many accounts remain active after they should have been retired, the research surfaces a lifecycle control failure that is broader than any single audit finding. Organisations that still rely on periodic clean-up are managing identity states that are already out of date. The practical conclusion is that lifecycle governance has to be continuous, owned, and measurable.
From our research library:
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
- Read next: NHI Lifecycle Management Guide
What this signals
Lifecycle control is moving from periodic cleanup to continuous governance. As organisations adopt cloud services and AI-assisted access to information, the value of a dormant account is no longer limited to missed cleanup. A stale identity can become a durable discovery path into systems and data that other controls assume are already governed.
Stale credentials now sit at the intersection of IAM and data security. When passwords never expire and inactive identities remain enabled, the question is no longer just who can log in. It is whether the organisation can still prove that access, data exposure, and business need remain aligned across the full identity lifecycle.
Continuous lifecycle telemetry will matter more than manual review cadence. Manual audits can describe the problem after it has grown, but they do not prevent stale access from accumulating between cycles. Organisations that want credible least privilege will need identity state changes, ownership, and exception handling to be visible as they happen.
For practitioners
- Automate inactive-account detection Set defined inactivity thresholds and disable accounts that exceed them unless a documented business owner reauthorises access.
- Review non-expiring passwords as exceptions Inventory every account configured with Password Never Expires and require a named owner, business justification, and review date.
- Bind offboarding to identity removal Connect HR and contractor exit events to account disablement so leaving a role also removes the associated credentials and permissions.
- Reduce certification noise before audits Remove dormant identities before access review cycles so reviewers validate current access rather than stale records.
Key takeaways
- Dormant accounts and never-expiring passwords are not isolated hygiene problems. They are signs that identity lifecycle governance is lagging the pace of organisational change.
- Lepide's research found inactive accounts in 90% of organisations assessed and non-expiring passwords in 90% as well, showing the issue is widespread rather than exceptional.
- The most effective response is continuous lifecycle control: tie offboarding, role change, and exception review directly to account disablement and credential rotation.
Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Ultimate Guide to NHIs: Key Challenges and Risks · NHI Ownership and Accountability Guide · Joiner-Mover-Leaver (JML) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Inactive accounts persist when offboarding fails to remove access at the right time. |
| NHI-07 — Long-Lived Secrets | Non-expiring passwords keep credentials valid far beyond their intended lifecycle. | |
| Recommendation — Automate offboarding so dormant identities are disabled before they become attack paths. Treat long-lived secrets as exceptions and rotate or revoke them on a defined cadence. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The research centres on whether access and entitlements still match business need. |
| Recommendation — Continuously remove unused entitlements and stale accounts from active identity stores. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Password lifetime and rotation are central to the credential hygiene findings. |
| Recommendation — Enforce authenticator lifecycle controls that prevent credentials from remaining valid indefinitely. | ||
| CIS Controls v8 | CIS-5 — Account Management | The benchmark findings directly concern account sprawl, dormant identities, and cleanup discipline. |
| Recommendation — Maintain account inventories and disable inactive accounts through formal account management processes. | ||
Key terms
- Inactive Account: An inactive account is an identity that still exists and may still hold privileges, even though it is no longer actively used. In practice, inactivity is a governance signal, not a security conclusion. The account should be reviewed, revalidated or removed before it becomes stale access.
- Password Never Expires: Password Never Expires is an account control setting that prevents a password from aging out automatically. It is sometimes used for service accounts to avoid application disruption, but it also increases long term exposure because compromised credentials can remain valid until they are manually changed or revoked.
- Identity Lifecycle Management: Identity Lifecycle Management is the process of creating, changing, reviewing, and removing digital identities across their full lifespan. It governs how users, service accounts, API keys, certificates, and other NHIs are provisioned, updated, certified, and deprovisioned to keep access aligned with business need, policy, and risk.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or lifecycle governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org