What breaks when offboarding only covers human accounts and not NHIs?

What actually breaks when offboarding ignores non-human identities?

The offboarding failure is not limited to a missed cleanup task. When the leaver’s machine access remains live, the organisation loses the link between access and accountable ownership. Tokens, keys, service accounts and agent identities can continue to authenticate long after the person is gone, so access review becomes guesswork and deprovisioning no longer means deprovisioning.

That matters because the break is structural, not administrative. Human joiner-mover-leaver workflows are built around people, while machine access often lives in cloud, CI/CD, SaaS and integration layers that are easy to overlook unless NHI lifecycle is tracked explicitly. NHI Lifecycle Management Guide and Joiner-Mover-Leaver (JML) Guide show why offboarding has to revoke both human and non-human access paths, not just the employee account.

The practical consequence is orphaned access. If no one is assigned to review or rotate the token, key or service account, the credential can outlive the employee, keep working in production, and become a hidden control gap. NHI Ownership and Accountability Guide makes the ownership problem explicit, because without a named owner, there is no reliable trigger for review, rotation or retirement.

Why orphaned NHIs create hidden attack surface

Orphaned machine access tends to fail quietly. Unlike a disabled user account, a long-lived API key or service principal can remain valid until it is discovered by inventory, incident response or an attacker. That creates exposure in environments where automation is normal and access is distributed across systems. The hidden risk is not just persistence, but uncertainty about where the credential works and whether it still has broad privileges.

This is why broader NHI guidance treats offboarding as a lifecycle and governance problem, not a one-time cleanup action. The strongest internal references here are Top 10 NHI Issues and Ultimate Guide to NHIs, Key Challenges and Risks, both of which emphasise orphaned identities, stale credentials, over-privilege and visibility gaps as recurring failure modes.

When the same credential is reused across cloud, CI/CD and SaaS, one missed offboarding step can preserve multiple access paths at once. That is why the problem is often discovered as blast radius, not as a single forgotten account.

What good offboarding has to remove, verify and re-own

Effective offboarding must treat NHI retirement as a required closure step. The access path should be identified, the owner confirmed, the credential revoked or rotated, and the downstream dependencies checked so that removing the token does not break a production workflow unintentionally. For shared or embedded service access, the question is not only whether the leaver is gone, but whether another controlled identity should replace the retired one.

Service Account Security Guide is useful here because service accounts often sit inside the exact systems that keep running after a human exit. Likewise, Human vs Non-Human Identity helps distinguish employee removal from machine identity retirement, which are related but operationally different tasks.

The deeper control issue is whether the organisation can prove that every credential issued during employment has been discovered and either transferred, rotated or revoked. If that evidence does not exist, offboarding is only partial.

Risk and Threat Considerations

Leaving NHI access active after employee exit creates a durable exposure window for misuse, lateral movement and credential theft. Attackers do not need the original employee to remain present; they only need a valid token, key or service account that still works and still reaches production systems.

Failure mechanism: Human offboarding closes the user account, but machine credentials remain valid because they were never inventoried, rotated or tied to a named owner. That breaks the deprovisioning chain and leaves an unauthorised but functional access path in place.

Impact: The organisation can retain invisible access into cloud, CI/CD and SaaS services, which can support persistence, privilege abuse, secret extraction and delayed incident discovery.

Practitioner Guidance

What to prioritise: Start with credentials that can still reach production, especially service accounts, API keys, refresh tokens and agent identities with broad scope or no expiry. Those are the offboarding misses most likely to matter operationally.

What to verify: Confirm that every leaver has a mapped set of non-human credentials, an owner for each one, and a disposal decision, revoke, rotate, transfer or justify retention. If the access cannot be explained from inventory, treat it as unresolved rather than assumed safe.

Common mistake: Teams often assume HR exit plus human account disablement equals complete offboarding. In practice, the real test is whether any surviving machine credential can still authenticate and do useful work after the employee has left.

Practitioner takeaway: Offboarding is complete only when the human account is closed and the machine access that depended on that person has been explicitly discovered, owned and removed or re-bound.

Related resources from NHI Mgmt Group

• What breaks when human offboarding is used as the only control for NHIs?
• What breaks when NHIs are managed like human user accounts?
• What is the difference between rotation and deprovisioning for NHIs?
• How should teams reduce the risk of orphaned service accounts and stale tokens?