How should operators measure whether dormant-account controls are working?

What to measure in dormant-account controls

Measure the control at the point where reactivation changes what the account can do, not just whether the account was once inactive. The useful signal is whether dormant-account status triggers fresh review before the next high-risk action, and whether that review is enforced consistently across withdrawal, privilege change, and external transfer paths.

Operationally, the best metric is the proportion of reactivated accounts that still require a linked review case before they can reach value-moving actions. If reactivation can proceed and later actions succeed without a new case, the control exists on paper but not in practice.

Good programmes also distinguish true reactivation from benign return-to-use. An account that simply logs in again is not the same as an account that regains the ability to move funds, change recovery details, or approve transactions. The measurement should therefore track whether state change, entitlement restoration, and action approval remain separated until review is complete.

How to tell whether the control is actually interrupting abuse

The strongest test is the “reactivate, then act” sequence. If dormant access can be restored, a claim can be made, and cash-out can happen before anyone is forced to review the case, the control has failed at the exact point it matters. For that reason, the metric should focus on time-to-escalation after reactivation, not just the number of dormant account found.

That sequence is exactly why dormant-account controls matter to access governance. NHIMG’s IAM and IGA Basics is useful here because dormant-account handling sits inside lifecycle governance, where access state and action approval should not be treated as the same event.

A second useful signal is surprise reduction. If investigators keep finding that accounts reactivated quietly and then completed late-stage actions before review, the control is not preventing the risky path. If those surprises decline and cases surface earlier in the workflow, the control is starting to work as intended.

What mature dormant-account programmes look like in practice

Mature controls do more than mark an account inactive. They force a decision before the account regains meaningful access, and they preserve evidence of who approved that change, when it happened, and what subsequent actions were permitted. That creates a defensible boundary between reactivation and later high-impact activity.

This is where posture monitoring and exception handling matter. NHIMG’s Identity Security Posture Management (ISPM) Guide helps frame dormant accounts as a standing hygiene issue, while the control signal you care about is whether the programme consistently detects stale access before it becomes an active path.

For remote-access heavy environments, the same measurement should be applied to legacy entry points. NHIMG’s Remote Access Identity Guide is relevant because dormant VPN or remote-access accounts often become the first place where stale access turns into undetected reactivation, especially when MFA or device checks are inconsistent.

Risk and Threat Considerations

Dormant-account controls fail when reactivation restores trust faster than it restores oversight. That creates a narrow but dangerous window where an attacker, fraudster, or insider can use a reawakened account to move from dormant state to material loss before any human review catches up.

Failure mechanism: The account is re-enabled, but downstream actions are not reclassified as higher risk, so withdrawal, profile change, or recovery-detail change proceeds without a linked case or approval gate.

Impact: Loss events become late-stage surprises, incident response starts after value has already moved, and the organisation cannot prove that dormant status meaningfully constrained abuse.

Practitioner Guidance

What to verify: Check whether reactivation automatically creates a review record and whether that record blocks later value-moving actions until it is closed. If the account can reactivate and transact in the same session, you do not yet have a meaningful dormant-account control.

What to measure: Track the percentage of reactivated accounts that reach sensitive actions before review, the time from reactivation to escalation, and the number of late-stage interventions that were caught only after a withdrawal or equivalent action was attempted.

Common mistake: Treating inactivity as the control objective. The real objective is to make reactivation observable, reviewable, and behaviorally different from normal access restoration.

Practitioner takeaway: A dormant-account control is working only when reactivation changes the risk posture of the next action, not merely the account flag; if review does not precede value movement, the control is cosmetic.

Related resources from NHI Mgmt Group

• How should security teams measure whether authentication controls are actually working?
• How should security teams measure whether trust controls are actually working?
• How can teams tell whether account recovery controls are working?
• How do organisations know whether service account controls are working?