Topic starter
11/11/2026 6:01 pm
TL;DR: Inactive accounts and non-expiring passwords remained widespread in Lepide's research, with 90% of organisations affected on both measures. Lifecycle governance has to account for identities that outlive the users, roles, and business need that created them.
Editorial analysis by NHI Mgmt Group, based on content published by Lepide: “The State of Identity and Data Security 2026”.
By the numbers:
- 90% of organisations assessed had enabled inactive user accounts.
- 90% of organisations had accounts configured with Password Never Expires.
- More than 5,900 inactive accounts were identified across the environments reviewed.
Key questions
Q: Why do non-expiring passwords create persistent security risk?
A: A password that never expires creates persistent risk because any theft, reuse, or shared use remains valid until the credential is changed or revoked.
Q: What is the difference between access reviews and lifecycle governance?
A: Access reviews are periodic checks that confirm whether existing permissions should remain in place.
Q: How do you find dormant accounts before they become an access risk?
A: Start by defining inactivity thresholds that fit the business, then look for enabled accounts that have not authenticated within those windows.
Practitioner guidance
- Automate inactive-account detection Set defined inactivity thresholds and disable accounts that exceed them unless a documented business owner reauthorises access.
- Review non-expiring passwords as exceptions Inventory every account configured with Password Never Expires and require a named owner, business justification, and review date.
- Bind offboarding to identity removal Connect HR and contractor exit events to account disablement so leaving a role also removes the associated credentials and permissions.
Bottom line: Dormant accounts and never-expiring passwords are not isolated hygiene problems. They are signs that identity lifecycle governance is lagging the pace of organisational change.
Glossary terms: Inactive Account, Password Never Expires, Identity Lifecycle Management, Access Certification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Dormant access is a lifecycle failure, not a housekeeping issue. Lepide's research shows that inactive accounts and non-expiring passwords accumulate when joiner, mover, and leaver processes lose pace with the business. The security problem is not the presence of one bad account, but the normalisation of identities that outlive their business purpose. That makes lifecycle governance a live attack-surface control, not an administrative chore.
A few things that frame the scale:
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: When should teams retire privileged service accounts?
A: Teams should retire privileged service accounts when the workload, integration, or owning team is decommissioned, and also when the account can be replaced by a scoped service identity or workload identity. Privileged service accounts should never remain in place after their administrative function ends, because they often carry standing access, stored secrets, and broad reach across systems.
👉 Read our full editorial: Identity lifecycle drift turns dormant access into lasting risk