Topic starter
28/05/2026 11:36 am
TL;DR: Layoffs, reorganisations, and mergers leave API keys, service accounts, and automation tokens behind, creating orphaned NHIs that persist with old privileges and little ownership context, according to Entro Security. The governance problem is not headcount change itself but unmanaged machine access that outlives the people who created it.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “Layoffs and Leftovers: When NHIs Outlive Their Owners”.
By the numbers:
- 1 out of every 1,000 NHIs in enterprise environments is more than 10 years old.
Key questions
Q: What breaks when NHIs are not included in employee offboarding?
A: The offboarding process stops at the person while the credentials, tokens, and service accounts they created keep running.
Q: Why do layoffs and M&A increase orphaned NHI risk?
A: They remove or obscure the people who can explain why a machine identity exists and who should own it next.
Q: How can security teams tell whether an NHI is orphaned?
A: Look for identities with no current owner, no documented purpose, no recent use, or no clear dependency in the systems they support.
Practitioner guidance
- Map machine identities to human owners Build an inventory that links every API key, service account, automation token, and hardcoded secret to a named business owner and a technical custodian.
- Reconcile NHIs during layoffs and M&A Run a post-change review for all inherited and departed identities, then identify which credentials are unused, over-privileged, or impossible to justify.
- Set retirement triggers for secrets Tie each secret to a decommission condition such as team exit, project closure, pipeline removal, or acquisition integration completion.
Bottom line: Layoffs and acquisitions expose a machine-identity governance gap because NHIs often stay active after the people who created them leave.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:40 am
Orphaned NHI risk is a lifecycle failure, not a staffing issue: layoffs and M&A expose a control boundary that many identity programmes still leave open. The problem is not headcount reduction by itself, but the fact that machine identities are often outside human offboarding workflows. That creates a class of access that survives the departure of the person who created it. Practitioners should treat lifecycle ownership for NHIs as a first-class governance requirement.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: Should organisations recertify NHIs separately from human accounts?
A: Yes. Human access reviews assume a person can explain their own access, but NHIs need lineage, runtime use, and lifecycle evidence instead. Separate review criteria prevent teams from certifying machine credentials that are still active but no longer justifiable.
👉 Read our full editorial: Layoffs expose the orphaned NHI problem in enterprise environments