Topic starter
11/08/2026 3:13 pm
TL;DR: Forgotten service credentials, OAuth grants, and orphaned accounts can still authenticate long after the original owner, project, or integration is gone, as Unixi’s analysis of the Klue breach shows. The real failure is governance drift: identity programmes often disable the user but leave the access path intact, which makes residual access a standing attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “The Account Nobody Remembered: Residual Access, Offboarding Debt, and Why the Vault Isn’t the Fix”.
Key questions
Q: What breaks when organisations disable the user but leave credentials and tokens active?
A: Offboarding fails because the real access path is not the directory account alone.
Q: Why do residual credentials create breach risk even without malware or phishing?
A: They preserve legitimate-looking access.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Map all residual access paths Inventory local passwords, OAuth grants, service credentials, API tokens, recovery addresses, and persistent sessions for each application, then tie each one to a current owner and business purpose.
- Revoke access outside the IdP Build a revocation workflow that reaches applications with direct authentication and delegated tokens, not only the central directory entry.
- Flag orphaned credentials as governance exceptions Create a review queue for credentials that lack a live owner, active project, or approved integration so they cannot remain in service by default.
Bottom line: Residual credentials are dangerous because they can keep authenticating after the owning user, project, or integration has been retired.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:27 pm
Residual access is a lifecycle failure, not an authentication failure. The breach condition in this article is not that attackers broke a password system. It is that an access path remained valid after ownership ended, which means the governance problem sits in offboarding, discovery, and revocation. Identity programmes that stop at user disablement are not closing the trust relationship they created. The practitioner conclusion is simple: if access can still be used, it has not been removed.
A few things that frame the scale:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between offboarding a user and revoking delegated access?
A: User offboarding removes the person from the directory or workforce system. Revoking delegated access removes the tokens, grants, sessions, and machine credentials that can keep working after the person is gone. In practice, both are required because a valid delegation can outlive the human identity that created it.
👉 Read our full editorial: Residual credentials and orphaned access remain breach-grade risk