TL;DR: Mergers and acquisitions can rapidly expand identity attack surfaces by inheriting dormant accounts, shadow privileges, orphaned service accounts, and fragmented IAM, IGA, and PAM controls, according to Hydden. The core problem is not integration speed alone, but the collapse of a single, trustworthy identity inventory across two environments.
At a glance
What this is: This analysis explains how M&A activity expands identity risk by importing hidden non-human identities, duplicated privileges, and fractured governance across the acquired and acquiring environments.
Why it matters: IAM, IGA, PAM, and NHI teams need a merger-specific control model because inherited access paths can outpace discovery, review, and deprovisioning during integration.
Context
Mergers and acquisitions expand identity risk because the acquiring organisation inherits every account, entitlement, and integration decision that already exists in the target environment. In practical terms, that means the identity problem is not just scale. It is the loss of a trusted inventory across two different governance models, which makes dormant accounts, shadow privileges, and stale machine access far harder to see.
The security gap is amplified when IAM, IGA, and PAM processes are merged on a rushed timeline. Day One access pressure often overrides normal review and remediation cycles, so inherited identities remain active longer than they should and access decisions are made with incomplete information. That makes merger integration a governance problem as much as a technical one.
Key questions
Q: What breaks when identity controls are merged after an acquisition without a full inventory?
A: A merger without a full identity inventory breaks ownership, entitlement traceability, and trust in access decisions. Security teams lose the ability to tell which accounts belong to whom, which privileges are still needed, and which non-human identities can be retired. That creates a governance gap that attackers can exploit before the new estate is fully reconciled.
Q: Why do dormant accounts and orphaned service accounts become more dangerous during M&A?
A: They become more dangerous because merger timelines create pressure to keep systems working while governance lags behind. Dormant accounts and orphaned service accounts often retain valid credentials or trust relationships, so they can provide quiet access long after their business purpose has ended. In a combined environment, that old access is harder to see and easier to abuse.
Q: What are the signs that post-merger access governance is failing?
A: Warning signs include delayed system decommissioning, lingering separation of acquired infrastructure, weak authentication that has not been remediated, and incomplete incident assessment after a breach. Those signals suggest the organisation is still operating the inherited environment as an exception rather than bringing it under normal control.
Q: When should organisations prioritise merger identity remediation over integration speed?
A: They should prioritise remediation as soon as access decisions begin to affect the combined environment, especially when inherited privileges, dormant accounts, or external trust links could expose high-value systems. If business continuity depends on risky access, that access should be narrowed before broader integration proceeds, not after an incident exposes the gap.
Technical breakdown
Why inherited identity estates become opaque during M&A
An acquisition imports two identity systems, two policy sets, and two sets of historical exceptions. If the organisations do not share a common identity model, security teams lose reliable linkage between accounts, owners, and entitlements. That creates blind spots for dormant accounts, duplicate access, and orphaned non-human identities such as service accounts and API keys. The deeper problem is that identity data stops being authoritative when it arrives from multiple directories, HR systems, SaaS tools, and cloud control planes with different definitions of ownership and privilege.
Practical implication: build a unified inventory before integration decisions create permanent access ambiguity.
Why day-one access creates configuration drift
M&A programmes often prioritise business continuity over access precision, so teams grant broad permissions to keep systems usable immediately after close. That introduces configuration drift when temporary access becomes permanent, policies differ between the two environments, and inherited exceptions are never normalised. For non-human identities, the risk is sharper because credentials, tokens, and service-linked permissions can continue operating even when the business context has changed. In this setting, privilege is not just excessive. It is also poorly documented and difficult to retire cleanly.
Practical implication: treat temporary integration access as a lifecycle state that must be explicitly reversed.
How attackers exploit orphaned non-human access paths
Attackers look for the access paths that integration teams leave behind. Orphaned service accounts, legacy API keys, stale SSO trust relationships, and delayed offboarding of former staff or contractors give them quiet persistence without needing to break new controls. This is why M&A becomes a high-value environment for lateral movement: the attack path often already exists in the inherited estate. Once a weak account or misaligned trust relationship is found, the attacker can move through the combined environment faster than the organisation can reconcile ownership and risk.
Practical implication: prioritise discovery of orphaned non-human access paths before attackers use them for persistence.
Threat narrative
Attacker objective: The attacker aims to turn merger complexity into durable access across the combined estate, then reach systems and data that become easier to compromise once identity controls are fragmented.
- Entry occurs through an inherited identity weakness such as a dormant account, stale trust relationship, or misconfigured access path in the acquired environment.
- Privilege is then abused through broad permissions, delayed offboarding, or unmanaged non-human credentials that remain valid after integration begins.
- The attacker moves laterally across the merged environment by using incompatible governance models and incomplete visibility to avoid early detection.
- Impact follows when the newly combined estate gives the attacker access to systems, data, or operational services that neither company could safely expose on their own.
Breaches seen in the wild
- Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
- McHire default password flaw 2025: A forgotten test admin account with the password 123456 and an API flaw exposed McDonald's McHire applicant records to researchers.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity chaos, not integration speed, is the real control failure in M&A. The acquiring organisation does not just inherit systems, it inherits identity debt, undocumented ownership, and old trust relationships that no one can quickly validate. That makes the merger period a live governance event rather than a post-close clean-up exercise. Practitioners should treat identity inventory quality as the first measure of merger readiness.
Fragmented IAM, IGA, and PAM models create a false sense of coverage. Each tool may still function inside its own boundary, but none of them provides a complete picture across both estates once the organisations begin to merge. The result is a governance gap where access looks manageable in individual systems but unsafe at the portfolio level. Teams need to recognise that partial visibility is not control.
Vendor claims about M&A efficiency miss the hidden non-human identity burden. Service accounts, API keys, inherited cloud permissions, and delayed deprovisioning all survive the transaction unless they are explicitly hunted down. Inherited identity debt: this is the accumulated non-human access that survives a deal closing and becomes the attacker’s working set. Security teams should assume every merger creates a temporary surge in exploitable NHI exposure.
Continuous discovery becomes mandatory once two identity histories collide. Point-in-time snapshots cannot keep up with day-one provisioning, exception handling, and post-close remediation. The governance model must move from static review to continuous reconciliation if it is to preserve trust in access decisions. Practitioners should assume that anything not continuously discovered is already drifting out of policy.
M&A exposes the limits of control models built for organisational stability. Access review, least privilege, and JIT are still necessary, but they only work if the underlying inventory is current and the ownership model is clear. In merger conditions, the first question is not which control to add. It is which identity records can still be trusted enough to govern.
What this signals
Inherited identity debt: merger programmes should treat dormant accounts, stale permissions, and orphaned non-human identities as liabilities that compound during integration rather than as clean-up items after close. If the inventory is incomplete, every access decision after Day One inherits uncertainty.
The practical shift is from static review to continuous reconciliation. In an M&A environment, access reviews alone are too slow unless they are backed by discovery that can keep pace with newly merged directories, SaaS estates, and cloud trust relationships.
For practitioners
- Build a pre-close identity inventory Map every human and non-human identity, entitlement, credential, and privileged relationship across both organisations before access is expanded.
- Reconcile duplicate and orphaned identities Correlate accounts to individuals and workloads across HR, directory, SaaS, cloud, and CI/CD systems to find stale access and ownership gaps.
- Audit inherited privileged access immediately Vault discovered privileged accounts and keys, then review whether each one still needs standing access after integration starts.
- Move temporary merger access into time-bounded governance Treat Day One permissions as short-lived integration access with explicit expiry, approval, and removal steps so temporary exceptions do not become permanent.
- Prioritise exposed non-human access paths first Focus remediation on service accounts, API keys, SSO trust links, and contractor access that can be used quietly during the integration window.
Key takeaways
- M&A creates a governance problem because the acquiring organisation inherits identity debt, not just systems and staff.
- The main risk is incomplete visibility into dormant accounts, orphaned service accounts, and inherited privileges across two environments.
- Security teams should reconcile identity ownership, privilege, and trust relationships before Day One access becomes permanent.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | M&A leaves former staff and contractors active when offboarding lags behind integration. |
| NHI-03 — Vulnerable Third-Party NHI | M&A commonly preserves external trust and vendor-linked identities that outlive the deal context. | |
| NHI-05 — Overprivileged NHI | The article centers on broad inherited access and excessive permissions across the merged estate. | |
| Recommendation — Track inherited accounts to closure and revoke access that no longer has a business owner. Review third-party and partner identities for stale trust relationships before integration completes. Reduce inherited non-human privilege to the minimum access needed for post-close operations. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about restoring control over merged entitlements and authorisations. |
| Recommendation — Validate merged permissions against business need and remove excessive access after close. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Account lifecycle control is central to inherited identities, dormant accounts, and delayed deprovisioning. |
| AC-6 — Least Privilege | The post highlights broad permissions and temporary access that exceed operational need. | |
| Recommendation — Manage all inherited accounts through a single account lifecycle process and remove accounts without owners. Apply least privilege to inherited identities before granting broad post-merger access. | ||
| MITRE ATT&CK | TA0003;TA0008 — Persistence; Lateral Movement | The threat pattern involves lingering access and movement through the merged environment. |
| Recommendation — Hunt for persistent access and lateral movement paths created by inherited identities and trust links. | ||
Key terms
- Identity Debt: Identity debt is the accumulation of unowned, over-permissioned, or poorly governed non-human identities that security teams cannot cleanly inventory or retire. It usually grows when experimentation outruns access governance, leaving service accounts and tokens active long after their original purpose has passed.
- Orphaned Service Account: An orphaned service account is a non-human identity that still exists and may still have permissions, but no longer has a clear active owner or business purpose. After an acquisition, orphaned accounts are a common source of hidden access because they are easy to forget and hard to trace.
- Identity Attack Surface Management: The practice of identifying and reducing the identity-related paths an attacker can use to gain or expand access. It covers accounts, permissions, trust relationships, authentication settings, and administrative workflows, with special attention to the places where identity compromise can become enterprise-wide compromise.
- Day 1 Access: Day 1 access is the ability for new or acquired employees to use the systems they need immediately after a merger or acquisition closes. In practice, it depends on automated onboarding, account creation, and policy alignment so productivity starts quickly without waiting for manual provisioning or ad hoc exceptions.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org