TL;DR: Mergers and acquisitions expand the identity attack surface by inheriting dormant accounts, shadow privileges, orphaned service accounts, and misconfigured SSO paths, according to Hydden. The real risk is that IAM, IGA, and PAM controls are built for stable estates, not for rapid integration with fragmented identity data and configuration drift.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Hydden's blog post: Mergers and acquisitions rapidly expand identity risk, with inherited NHI sprawl, governance fragmentation, and configuration drift as the core findings.
Why it matters: It matters because IAM, IGA, and PAM programmes often assume a stable estate, but M&A forces practitioners to govern inherited humans, machines, and access paths before the combined environment is even fully understood.
Context
Mergers and acquisitions do not just combine companies, they combine identity estates that were built with different rules, tools, and levels of discipline. The security problem is not the deal itself but the inherited mix of dormant accounts, orphaned service identities, misconfigured trust paths, and undocumented access that sits inside the acquired environment.
For IAM and NHI teams, the challenge is governance under compressed timelines. Day One access pressure pushes organisations toward fast integration before identity inventory, privilege mapping, and deprovisioning are complete, which turns incomplete visibility into operational risk.
The article frames this as a control gap across human and non-human access, not a one-off misconfiguration. That is typical of M&A, where the real exposure comes from scale, fragmentation, and the speed at which new trust relationships are created.
Key questions
Q: What breaks when identity governance is not in place during an acquisition?
A: Without identity governance, merger teams lose track of who owns access, which accounts are temporary, and where privileged rights overlap. That creates orphaned access, unresolved segregation-of-duties conflicts, and hidden trust between environments. The result is a larger attack surface and a longer window for misuse during the integration period.
Q: Why do orphaned service accounts create so much risk after an acquisition?
A: Orphaned service accounts are dangerous because they often keep working after the original owner has left or the original environment has changed. In a merger, that persistence turns old access into live access, especially when the account still reaches production systems, cloud resources, or connected SaaS platforms.
Q: How do security teams know if inherited access is actually under control?
A: They know it is under control only when duplicate accounts are removed, privileged access is vault-managed, stale credentials are rotated, and each identity has a clear owner. If those conditions are not measurable across both estates, the merger is still carrying hidden access risk, even if business systems are already connected.
Q: What should IAM teams do when two companies use different access models?
A: IAM teams should establish a temporary control baseline that covers both estates, then normalise authentication, entitlement, and privileged access policies before expanding trust. The point is not to preserve both models indefinitely. It is to reduce the combined estate to one governed identity plane as quickly as possible.
Technical breakdown
Why identity estates fracture during M&A
M&A creates two overlapping identity systems that usually have different directories, entitlement models, authentication paths, and privileged access practices. That fragmentation matters because IAM, IGA, and PAM controls depend on a reliable source of truth, and in a merger there often is none. The result is duplicated accounts, conflicting policy assumptions, and trust relationships that are created for speed rather than governance. When access decisions are made before identity data is reconciled, security teams inherit risk they cannot yet measure accurately.
Practical implication: treat identity inventory and entitlement reconciliation as prerequisites for integration, not post-integration cleanup.
How orphaned service accounts and shadow privileges persist
Non-human identities are especially hard to govern in M&A because service accounts, API keys, and automation credentials often sit outside HR-driven lifecycle processes. These identities can survive long after the systems or teams that created them have changed, and legacy integrations can keep them active even when they are no longer visible to the acquiring organisation. Shadow privileges also arise when permissions are copied forward during migration, leaving access that no one can easily justify. That combination expands the attack surface far beyond the visible user population.
Practical implication: build a dedicated inventory for inherited NHI credentials and map each one to an owner, system, and business purpose.
Why Day One access creates configuration drift
M&A timelines often prioritise business continuity over security completeness, so teams grant broad access and connect systems before controls are normalised. That produces configuration drift, which is the widening gap between intended policy and the permissions actually operating in the environment. In a merged estate, drift is not a cosmetic issue. It can create misaligned SSO trust, inconsistent MFA enforcement, and privileged access that remains broader than the target state for weeks or months. Attackers look for exactly that period of temporary exception.
Practical implication: use temporary access with explicit expiry and review merged trust paths continuously until the estate is normalised.
Threat narrative
Attacker objective: The attacker aims to exploit merger-driven identity chaos to gain durable access before the combined organisation has normalised its controls.
- Entry begins with inherited access paths, including dormant accounts, forgotten contractors, and service identities that remain valid after the acquisition.
- Credential or privilege abuse follows when attackers find misconfigured SSO trust, stale credentials, or overbroad inherited permissions inside the combined estate.
- Escalation occurs as the attacker moves through fragmented governance and uses privileged or redundant access to reach higher-value systems.
- Impact is the compromise of critical applications, data, or operational systems during the integration window, before the new estate is fully governed.
Breaches seen in the wild
- Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
- McHire default password flaw 2025: A forgotten test admin account with the password 123456 and an API flaw exposed McDonald's McHire applicant records to researchers.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
M&A creates identity debt faster than governance can absorb it: The merged estate inherits accounts, entitlements, trust relationships, and machine identities that were never designed to be governed as one. That is why the most dangerous risk is not a single bad account but the accumulation of identity debt across two operating models. Practitioners should treat integration as an identity reconstruction problem, not just an access migration.
Inherited NHI risk is the least visible part of merger exposure: Service accounts, API keys, and automation credentials often survive because nobody owns their lifecycle during the transition. Those identities do not wait for human review cycles, which means old permissions can remain active long after the business relationship or system dependency has changed. The practitioner conclusion is simple: if you cannot explain the purpose of an inherited NHI, you do not yet control it.
Standing access assumptions collapse in a merged environment: Access review processes were designed for estates where accounts persist long enough to be certified, revoked, or revalidated. M&A disrupts that assumption because access is created, copied, and expanded faster than review cycles can catch up, so governance loses its temporal model of control. Teams must rethink how they establish accountability when inherited access outpaces certification.
Identity attack surface management becomes the merger control plane: The article points to a named concept that describes the real operating need here. IASM is not a visibility add-on, it is the mechanism for continuously reconciling identities, entitlements, and trust paths across two estates. Practitioners should treat continuous discovery as the control that tells them where inherited risk actually lives.
Speed is now an identity risk multiplier, not a project metric: M&A programmes often celebrate how fast systems are connected, but the article shows that speed mainly determines how much unmanaged access survives the transition. That makes governance timing a security decision, not a delivery detail. Identity teams should therefore prioritise containment of inherited exposure before they optimise for integration completion.
What this signals
Identity reconciliation is the first security product of M&A: Before the combined business can trust its access model, it has to know which identities exist, who or what owns them, and which privileges are still active. That means the merger programme should treat identity inventory as a gating control, not an after-the-fact audit exercise.
M&A also exposes the gap between lifecycle governance and real-world speed. Access reviews, offboarding, and privileged access management were built for stable estates, while integration work creates temporary exceptions that can last long enough to become permanent. Security leaders should expect that the first failure mode will be governance lag, not a single catastrophic exploit.
For practitioners
- Map every inherited identity before Day One Build a pre-merger inventory of human accounts, service accounts, API keys, certificates, and privileged entitlements across both estates before access is expanded.
- Reconcile trust paths and SSO integrations early Review federated trust, SSO configurations, and cross-domain authentication paths to remove unintended trust relationships created by the merger.
- Isolate inherited privileged access immediately Vault privileged accounts and keys as soon as they are discovered, then reduce standing access to the smallest viable set while integration work continues.
- Track orphaned NHI credentials separately Place service accounts, API keys, and other automation credentials on a dedicated remediation list with named owners and explicit expiry dates.
- Use continuous discovery during integration Move from point-in-time snapshots to continuous monitoring of new identities, privilege changes, and anomalous access patterns throughout the merger window.
Key takeaways
- M&A risk is fundamentally an identity governance problem because the combined estate inherits accounts, privileges, and trust paths that were not designed to be managed together.
- The article shows that the most dangerous exposure comes from dormant accounts, orphaned service identities, misconfigured SSO, and rushed access expansion during integration.
- Teams reduce inherited risk by inventorying identities early, constraining privileged access immediately, and using continuous discovery until the merged environment is stable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | M&A often leaves former employee, contractor, and system access active after the business changes. |
| NHI-05 — Overprivileged NHI | The article highlights broad inherited permissions and shadow privileges inside merged estates. | |
| NHI-03 — Vulnerable Third-Party NHI | Merged environments often preserve external integrations and vendor-linked access that were never revalidated. | |
| Recommendation — Audit inherited accounts for offboarding gaps and revoke access that no longer maps to an active business need. Reduce inherited NHI permissions to the minimum necessary scope before normal operations resume. Revalidate third-party NHI access during integration and remove trust that lacks current ownership. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about reconciling entitlements and controlling inherited access across two estates. |
| Recommendation — Reassess entitlements across the merged environment and tighten authorizations before expanding connectivity. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle hygiene is central to clearing dormant and orphaned identities after M&A. |
| Recommendation — Use account management controls to find, review, and remove inherited accounts that no longer belong in service. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The threat pattern in the article is attacker use of inherited access to move through the merged estate. |
| Recommendation — Map merger-era exposure to credential access and lateral movement so detection focuses on inherited trust paths. | ||
Key terms
- Identity Attack Surface Management: The practice of identifying and reducing the identity-related paths an attacker can use to gain or expand access. It covers accounts, permissions, trust relationships, authentication settings, and administrative workflows, with special attention to the places where identity compromise can become enterprise-wide compromise.
- Configuration Drift: Configuration drift is the gradual divergence between a system's intended secure state and the settings it actually runs with over time. In SaaS, drift often appears when admins change sharing, logging, or access controls under pressure and never return to validate the result.
- Inherited NHI Risk: Inherited NHI risk is the exposure created when an organisation acquires service accounts, API keys, tokens, certificates, and other non-human identities without fully understanding their lifecycle. The danger is that these credentials often outlive the teams, systems, or business reasons that created them.
- Shadow Privilege: Shadow privilege is unmanaged or unnecessary elevated access that accumulates outside normal governance processes. It includes accounts, secrets, and entitlements that are unknown, poorly owned, or left active after their original purpose has passed, creating hidden pathways into sensitive systems.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org