Topic starter
06/07/2026 9:41 am
TL;DR: M&A integration concentrates non-human identity risk because service accounts, tokens, and machine credentials outlive ownership boundaries and often remain overprivileged, according to Token Security; the article cites 46% of organisations experiencing NHI-related breaches and 91% of former employee tokens staying active. The governance problem is not just discovery, but proving who can revoke, rotate, and inherit each identity before the combined environment becomes one attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Identity Due Diligence: Managing Non-Human Identity Security in M&A”.
By the numbers:
- NHIs outnumber human identities by 45:1 in the article's M&A example.
- 46% of organisations have experienced breaches related to non-human identities.
- 91% of former employee tokens remain active.
Key questions
Q: What breaks when non-human identities are left out of M&A due diligence?
A: What breaks is accountability.
Q: Why do stale tokens and service accounts increase risk after a merger?
A: They extend the old trust boundary into the new organisation.
Q: How can security teams tell whether NHI governance is working?
A: They should look for fewer orphaned accounts, shorter credential lifetimes, lower secret reuse and faster decommissioning when systems or projects end.
Practitioner guidance
- Map every non-human identity before integration Build a pre-close inventory of service accounts, tokens, API keys, CI/CD credentials, and automation identities across both organisations, then reconcile each one to a named business or technical owner.
- Assign ownership transfer for inherited machine identities For each NHI, define who can revoke, rotate, approve, and inherit it after close, and block any identity that cannot be assigned a clear post-deal owner.
- Revoke or rotate stale credentials at integration milestones Tie secret rotation and deprovisioning to merger checkpoints so orphaned tokens, unused keys, and obsolete service accounts do not survive the handover.
Bottom line: M&A due diligence fails when it inventories systems but not machine identities, leaving service accounts and tokens outside the ownership model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:57 am
Identity due diligence fails when machine identities are treated as side effects of IT integration rather than assets in scope. The article's core problem is not discovery alone, but the absence of a governance model that can attribute, validate, and transfer responsibility for NHIs at deal speed. M&A teams that cannot answer who owns each service account or token are already operating with incomplete control. The practitioner conclusion is that NHI inventory must be part of transaction readiness, not post-close cleanup.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: What happens when two organisations combine privileged access without reconciling NHIs?
A: The merged estate inherits overlapping permissions, hidden service access, and toxic combinations that were never designed to coexist. That can widen the attack surface immediately, because the new environment may expose more paths than either organisation intended on its own.
👉 Read our full editorial: M&A identity due diligence is failing on non-human identities