M&A identity due diligence is failing on non-human identities

At a glance

What this is: This blog argues that M&A identity due diligence breaks down when service accounts, tokens, API keys, and other NHIs are left outside the integration plan.

Why it matters: It matters because IAM and PAM teams need a machine-identity view of ownership, privilege, and offboarding before two environments are merged into one attack surface.

By the numbers:

• NHIs outnumber human identities by 45:1 in the article's M&A example.
• 46% of organisations have experienced breaches related to non-human identities.
• 91% of former employee tokens remain active.
• 31% of companies have seen assets accessed after termination.

Context

M&A identity due diligence is the process of inventorying, validating, and reconciling identities before two organisations combine. In this article, the governance gap is that the review often centres on human accounts and financial control points while NHIs, service accounts, API keys, tokens, and automation scripts remain under-attributed.

That matters because machine identities usually persist beyond employee changes, technology migration, or ownership handover. When two environments merge, the problem is not just finding the identities but proving who can revoke them, rotate them, and inherit responsibility for them without leaving hidden access behind.

Key questions

Q: What breaks when non-human identities are left out of M&A due diligence?

A: What breaks is accountability. Service accounts, tokens, and automation identities can survive the transaction with no clear owner, no agreed revocation path, and no verified rotation plan. That leaves the merged environment exposed to stale access, privilege inheritance, and hidden dependencies that human-only diligence will miss.

Q: Why do stale tokens and service accounts increase risk after a merger?

A: They extend the old trust boundary into the new organisation. If a credential still works after ownership changes, the acquirer inherits access it may not understand, monitor, or need. That creates a long-lived path for misuse, especially where privileged access and legacy integrations were never reconciled.

Q: How can security teams tell whether NHI governance is working?

A: They should look for fewer orphaned accounts, shorter credential lifetimes, lower secret reuse and faster decommissioning when systems or projects end. If credentials still survive after business purpose has ended, the governance model is not controlling the lifecycle effectively.

Q: What happens when two organisations combine privileged access without reconciling NHIs?

A: The merged estate inherits overlapping permissions, hidden service access, and toxic combinations that were never designed to coexist. That can widen the attack surface immediately, because the new environment may expose more paths than either organisation intended on its own.

Technical breakdown

Why NHI inventories break during M&A integration

M&A integration pulls together two identity estates that were never built to describe machine access in the same way. Service accounts, CI/CD credentials, scripts, and workload tokens often sit outside standard IAM records, which means ownership is implicit, local, or completely undocumented. Once systems are combined, duplicate identities, stale credentials, and untracked integrations become difficult to distinguish from legitimate production access. The technical issue is not just scale, but the mismatch between how NHIs are created and how most integration teams try to inventory them.

Practical implication: build a pre-close NHI inventory that reconciles ownership, system scope, and privilege before cutover work begins.

How stale secrets become a post-deal attack path

Secrets, tokens, API keys, and machine credentials can remain valid long after the people or systems that created them have changed. In an M&A context, that persistence is dangerous because one company may inherit another company's forgotten access paths without inheriting its operational context. Poor rotation and weak offboarding create a long-lived trust window in which old credentials continue to authenticate successfully. That is why credential hygiene is a lifecycle problem, not a point-in-time review.

Practical implication: map every inherited secret to an owner, rotation rule, and revocation path before the combined environment is treated as steady state.

Why excessive privileges hide in merged cloud estates

Cloud and SaaS access often looks manageable until two permission models collide. Then the combined estate exposes toxic combinations, overprivileged service identities, and hidden inherited entitlements that were never intended to coexist. Least privilege becomes harder to enforce because teams are trying to normalise two different operational models at once, often under merger deadlines. The result is that access boundaries become broader exactly when the organisation can least afford them.

Practical implication: run privilege reconciliation early and separate inherited access from approved production access before business-as-usual resumes.

Threat narrative

Attacker objective: The attacker wants durable access to the merged environment through identities the organisation forgot to reconcile.

1. Entry begins when orphaned or shadow NHIs survive the merger and remain authenticated in the combined environment.
2. Escalation occurs when stale tokens, overprivileged service accounts, or undocumented integrations expose broader access than the business intended.
3. Impact follows when those identities are used to access systems, leak data, or bypass the new organisation's control boundaries.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity due diligence fails when machine identities are treated as side effects of IT integration rather than assets in scope. The article's core problem is not discovery alone, but the absence of a governance model that can attribute, validate, and transfer responsibility for NHIs at deal speed. M&A teams that cannot answer who owns each service account or token are already operating with incomplete control. The practitioner conclusion is that NHI inventory must be part of transaction readiness, not post-close cleanup.

Ephemeral ownership assumptions collapse in M&A because NHIs outlive the people and project structures that created them. Human-centred offboarding assumes a clear leaver event, but service accounts and secrets often persist across teams, tools, and vendors. That leaves a gap between business change and credential change that attackers can exploit. The practitioner conclusion is that ownership transfer and revocation logic must be explicit for every machine identity.

Long-lived secret persistence is the defining M&A identity risk. The article shows that the security issue is not merely privilege, but the fact that tokens and keys can remain active after the original business context has changed. This is the condition that turns merger complexity into a prolonged attack window. The practitioner conclusion is that rotation and deprovisioning must be tied to integration milestones, not annual review cycles.

Shadow NHI creates identity blast radius inside the newly combined enterprise. Once unmonitored automation scripts and unmanaged service accounts exist in both organisations, the merged estate inherits unknown paths into production systems. That uncertainty expands the blast radius of any single compromised identity because no one can reliably trace what it can reach. The practitioner conclusion is that merger integration should treat unowned access as a containment issue, not just an inventory gap.

Machine-first identity governance is now a merger control, not a niche security preference. Traditional human IAM controls do not address the way NHIs authenticate, persist, and inherit permissions across complex technology estates. The article is right to frame attribution and behavioural control as the governing model, because merger risk sits in the machine layer first. The practitioner conclusion is that due diligence must evaluate NHI lifecycle control with the same seriousness as financial and legal diligence.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Identity due diligence now has to cover machine identity lifecycle, not just account discovery. In an M&A setting, the real risk is the gap between finding an NHI and proving who can rotate, revoke, or inherit it after the transaction closes. That is a lifecycle governance problem, and the merged environment will expose it quickly if ownership remains ambiguous.

Shadow identities turn merger integration into a blast-radius problem. Once unowned automation, forgotten tokens, and inherited service accounts enter the combined estate, the organisation loses certainty about which access paths are legitimate. That uncertainty makes containment harder than discovery and pushes teams toward pre-close attribution instead of post-close cleanup.

For practitioners

• Map every non-human identity before integration Build a pre-close inventory of service accounts, tokens, API keys, CI/CD credentials, and automation identities across both organisations, then reconcile each one to a named business or technical owner.
• Assign ownership transfer for inherited machine identities For each NHI, define who can revoke, rotate, approve, and inherit it after close, and block any identity that cannot be assigned a clear post-deal owner.
• Revoke or rotate stale credentials at integration milestones Tie secret rotation and deprovisioning to merger checkpoints so orphaned tokens, unused keys, and obsolete service accounts do not survive the handover.
• Reconcile privilege before combining environments Identify overprivileged NHIs, toxic access combinations, and cross-cloud entitlements early, then separate inherited access from approved production access.
• Treat shadow identities as merger-risk indicators Use discovery and attribution to surface unmonitored workloads, hidden automation, and undeclared third-party identities before the combined estate becomes a single attack surface.

Key takeaways

• M&A due diligence fails when it inventories systems but not machine identities, leaving service accounts and tokens outside the ownership model.
• The article's evidence points to a large and persistent exposure surface, including 91% of former employee tokens remaining active and 31% of companies seeing assets accessed after termination.
• The control that matters most is not just discovery but clear attribution, rotation, and revocation authority for every inherited NHI before integration proceeds.

Key terms

• Non-Human Identity Due Diligence: The process of identifying, validating, and assigning accountability for service accounts, tokens, keys, and other machine identities before an acquisition is completed. In M&A, it extends beyond inventory to ownership transfer, lifecycle control, and proof that inherited access can be revoked or rotated safely.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Shadow NHI: A non-human identity created outside of formal governance processes and not tracked, managed, or known to the security team, creating an unmonitored attack surface. Shadow NHIs are commonly discovered during incident investigations.
• Machine-First Identity Governance: An identity governance approach that treats service accounts, tokens, APIs, and automation identities as first-class assets with their own lifecycle controls. For M&A, it means managing attribution, privilege, rotation, and revocation for NHIs separately from human-centric IAM assumptions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.