Layoffs expose the orphaned NHI problem in enterprise environments

At a glance

What this is: This is a blog analysis of how layoffs and mergers create orphaned NHIs when machine identities outlive the people who created them.

Why it matters: It matters because IAM teams need lifecycle controls for service accounts, tokens, and secrets that survive staff changes, not just human offboarding.

By the numbers:

• 1 out of every 1,000 NHIs in enterprise environments is more than 10 years old.

Context

Layoffs, restructurings, and M&A do not just move people around. They also disrupt the ownership and oversight of non-human identities such as API keys, service accounts, automation tokens, and hardcoded secrets.

The security gap appears when those identities keep working after their creators leave. In NHI governance terms, the problem is lifecycle decay: access persists, ownership disappears, and the environment loses the context needed to decide whether the identity is still justified.

That makes workforce change a machine-identity issue as much as a human one. The article's central point is that offboarding processes often stop at the employee, while the credential estate left behind continues to operate.

Key questions

Q: What breaks when NHIs are not included in employee offboarding?

A: The offboarding process stops at the person while the credentials, tokens, and service accounts they created keep running. That leaves live access without accountable ownership, which makes orphaned NHIs hard to justify, hard to review, and easy to overlook during change events.

Q: Why do layoffs and M&A increase orphaned NHI risk?

A: They remove or obscure the people who can explain why a machine identity exists and who should own it next. When the context disappears, secrets often stay active with the same privileges, which expands hidden access and makes cleanup slower and less reliable.

Q: How can security teams tell whether an NHI is orphaned?

A: Look for identities with no current owner, no documented purpose, no recent use, or no clear dependency in the systems they support. If the credential survives but the business reason does not, it should be treated as orphaned until proven otherwise.

Q: Should organisations recertify NHIs separately from human accounts?

A: Yes. Human access reviews assume a person can explain their own access, but NHIs need lineage, runtime use, and lifecycle evidence instead. Separate review criteria prevent teams from certifying machine credentials that are still active but no longer justifiable.

Technical breakdown

How orphaned NHIs persist after employee offboarding

An orphaned NHI is a machine identity that remains active after the person, team, or project that created it is gone. In practice, that means the credential, token, or service account still exists in code, pipelines, or cloud infrastructure, often with unchanged permissions. The failure is not just forgotten cleanup. It is that NHIs are embedded into workflows that keep running, so they are easy to miss during human offboarding. Without linkage between creator, purpose, and owner, the identity outlives the governance process that should have retired it.

Practical implication: inventory machine identities by creator, owner, and dependency so offboarding can reach the identity, not only the employee.

Why M&A creates a larger orphaned NHI problem

M&A expands the problem because the acquiring organisation inherits another estate of scripts, automations, and secrets with little context. Those assets may number in the thousands or even hundreds of thousands, but scale alone is not the core issue. The real issue is that the inherited identities arrive without clear lineage, business purpose, or accountable owner. That makes risk triage hard: security teams cannot easily tell which credentials are dormant, over-privileged, or still tied to live workflows. The result is a hidden access layer that survives integration activity.

Practical implication: treat acquisition onboarding as an identity inventory exercise, not just an application and infrastructure integration task.

How ownership loss turns routine secrets into enduring exposure

When ownership is missing, a secret becomes durable risk rather than a temporary control. API keys, service accounts, and automation tokens often keep the same access they had on day one, even when the creator is no longer present to explain their purpose. That creates a gap between access and accountability. The longer the identity remains unmanaged, the more likely it is to become idle, over-privileged, or impossible to justify during audit. In NHI governance, persistence without ownership is the condition that turns operational convenience into latent exposure.

Practical implication: pair every secret with a current owner and a retirement trigger, then remove identities that cannot be justified.

Threat narrative

Attacker objective: Exploit unmanaged machine identities that no longer have accountable ownership or clear business justification.

1. Entry occurs when layoffs or acquisitions leave behind active API keys, service accounts, and automation tokens that were never tied into a proper offboarding workflow.
2. Escalation follows when those identities retain the same privileges after the human owner has left, giving an attacker or auditor-facing blind spot access to live systems.
3. Impact comes from long-lived, poorly attributed machine access that persists across organisational change and can be reused, abused, or left to accumulate risk.
4. The attacker objective is to exploit unmanaged machine identities that no longer have accountable ownership or clear business justification.

Breaches seen in the wild

• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Orphaned NHI risk is a lifecycle failure, not a staffing issue: layoffs and M&A expose a control boundary that many identity programmes still leave open. The problem is not headcount reduction by itself, but the fact that machine identities are often outside human offboarding workflows. That creates a class of access that survives the departure of the person who created it. Practitioners should treat lifecycle ownership for NHIs as a first-class governance requirement.

Identity lineage is the missing control in post-change environments: if security teams cannot trace who created a secret, what it supports, and who now owns it, then they cannot make a defensible access decision. Lineage is what lets teams distinguish a live dependency from abandoned access. Without it, inherited environments become audit liabilities and attacker opportunities at the same time. The practical lesson is that visibility without ownership is only partial control.

Orphaned secrets create a hidden privilege pool that outlives the org chart: the article shows how credentials continue to function after the business context that justified them has changed. That is a governance assumption failure, because the programme assumes access will be reviewed while the original owner is still available. In reality, NHIs often persist longer than the employee tenure that created them, so the control window never matches the asset lifecycle. Teams need to govern the identity estate, not the departure event.

Layoffs and acquisitions should trigger machine-identity reconciliation, not just access review: traditional recertification can miss NHIs because the reviewer sees a live credential, not the context of why it exists. That means the review process must surface creator, dependency, and runtime use, or it will simply certify old access. The article's deeper signal is that workforce change is now a machine identity stress test. Security leaders should assume the next orphaned credential is already inside the inherited estate.

Orphaned NHI exposure is becoming a board-level integration risk: the more organisations adopt automation and AI-enabled workflows, the larger the population of identities that can be left behind during change. That widens the gap between human lifecycle governance and machine lifecycle governance. The implication is straightforward: mergers, restructurings, and reductions in force now need identity controls that can retire non-human access as reliably as they retire people.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Identity lineage becomes the control that determines whether a credential is still defensible: once the creator is gone, the business must be able to explain why the identity exists and who now owns its lifecycle. Without that traceability, an NHI is functionally unmanaged even if it is still technically operational.

Machine-identity sprawl now follows organisational change as closely as it follows engineering change: restructures, exits, and acquisitions are no longer just HR or M&A events. They are the moments when dormant access, unowned secrets, and forgotten automation suddenly become visible to attackers and auditors alike.

For practitioners

• Map machine identities to human owners Build an inventory that links every API key, service account, automation token, and hardcoded secret to a named business owner and a technical custodian.
• Reconcile NHIs during layoffs and M&A Run a post-change review for all inherited and departed identities, then identify which credentials are unused, over-privileged, or impossible to justify.
• Set retirement triggers for secrets Tie each secret to a decommission condition such as team exit, project closure, pipeline removal, or acquisition integration completion.
• Require lineage before recertification Only certify an NHI when its creator, purpose, dependencies, and current owner are known and documented in the identity record.

Key takeaways

• Layoffs and acquisitions expose a machine-identity governance gap because NHIs often stay active after the people who created them leave.
• The article highlights long-lived orphaned access as a persistent enterprise condition, not a one-off cleanup problem.
• The practical answer is to tie every secret to ownership, purpose, and retirement conditions before organisational change creates blind spots.

Key terms

• Orphaned NHI: An orphaned NHI is a non-human identity that remains active without a clear owner, business purpose, or lifecycle path. These identities often survive employee departures, application changes, or missed deprovisioning steps, which makes them difficult to review and risky to leave in place.
• Identity Lineage: Identity lineage is the traceable relationship between a human owner and the non-human identities that person creates, authorises, or depends on. It allows security teams to connect service accounts, API keys, tokens, and AI agents back to accountable ownership for review, audit, and retirement decisions.
• Ownership Attribution: Ownership attribution is the process of tying an identity to an accountable application, vendor, or internal team. It is a governance requirement, not a nice-to-have, because lifecycle actions such as rotation, offboarding, and recertification depend on knowing who is responsible for the identity and its downstream impact.
• Machine Identity Offboarding: Machine identity offboarding is the process of retiring credentials, tokens, service accounts, and related access when the associated system or business need no longer exists. Unlike human offboarding, it must also account for hidden dependencies in code, pipelines, and automation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.