What breaks when organisations let agencies use their own credentials to manage brand accounts?

Why Shared Agency Logins Create an Identity and Control Problem

Brand accounts are not just communication channels; they are governed assets. When an outside agency uses its own credentials to manage them, the organisation loses a clean line between who owns the account, who can approve changes, and who can remove access when the relationship ends. That creates a control gap that can turn routine marketing work into a persistent access and accountability problem. For a broader control lens, NIST Cybersecurity Framework 2.0 helps teams treat ownership, governance, and recovery as part of the security posture, not just the operations workflow. In practice, many security teams discover the problem only after an agency relationship changes and access removal turns out to be incomplete.

How It Works in Practice

The issue is usually not the login itself but the identity model behind it. If an agency signs in with staff-owned accounts, the organisation may never receive direct administrative control of the brand profile, its permissions structure, or the connected recovery paths. The agency may also create the profile using its own email domain, phone number, or recovery methods, which means the account lifecycle remains tied to the vendor rather than the brand.

That creates several operational failures. Offboarding becomes uncertain because the organisation cannot always prove which identities exist, who controls them, or whether the right permissions were removed. Audit trails become fragmented because activity is attributed to external users instead of a brand-owned administrative model. If the agency employee leaves, changes role, or loses access, the brand account may still depend on credentials that the organisation cannot reset. If an agency retains access after contract expiry, the brand can be exposed to posting, messaging, or profile changes that no internal team can reliably prevent.

A stronger model is to treat the brand account as an organisation-owned asset with direct administrative control, then grant the agency only the minimum delegated access needed for the work. That may involve role separation, documented ownership, and explicit transfer or revocation steps when the relationship changes. In practice, the most important question is not whether the agency can log in, but whether the organisation can independently recover, revoke, and govern the account at any time. This guidance breaks down when the platform itself offers limited delegation or poor administrative separation, because then the account design rather than the process becomes the controlling constraint.

Where Ghost Accounts, Offboarding Gaps, and Misrepresentation Risks Emerge

Tighter access delegation often increases administrative overhead, requiring organisations to balance operational convenience against ownership and revocation certainty.

Shared external credentials create a lifecycle risk that gets worse over time. Once an agency controls creation, recovery, or primary access, the brand account can outlive the relationship that produced it. That is where ghost accounts emerge: profiles that still appear authoritative but are no longer under the organisation’s effective control. The resulting risk is not only loss of access, but also misrepresentation, because outsiders may continue to trust a brand presence that the organisation cannot fully verify or manage. If the account is used for advertising, customer messaging, or public-facing updates, the exposure becomes both reputational and operational.

NIST Cybersecurity Framework 2.0 is useful here because the failure is fundamentally about governance, access control, and recovery ownership. When the organisation cannot demonstrate who can revoke access or restore control, the account should be treated as unmanaged rather than merely inconvenient. In some environments, the platform structure makes full transfer difficult, and that should be handled as a higher-risk exception rather than normal practice.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.OC-01 — Organizational Context	Brand account ownership and accountability are governance-context issues.
	PR.AA-01 — Identity Management, Authentication, and Access Control	Using agency credentials blurs authentication and revocation control.
	RC.RP-01 — Recovery Plan Execution	Ghost accounts persist when the organisation cannot recover control after offboarding.
Recommendation — Define brand account ownership and approval boundaries before delegating agency access. Assign access through organisation-controlled identities and revoke them centrally. Test that the brand can be restored and secured without agency cooperation.
CIS Controls v8	5.1 — Establish and Maintain an Inventory of Accounts	Hidden agency-owned brand logins are often absent from account inventories.
	6.3 — Require MFA for Externally-Exposed Applications	Externally managed brand access increases the need for stronger login protection.
Recommendation — Inventory every brand account and record who can administer or revoke it. Require strong authentication for any delegated access that remains externally reachable.
MITRE ATT&CK	T1098 — Account Manipulation	Vendor-held access can leave dormant or misused accounts behind after relationship changes.
Recommendation — Monitor for account persistence and remove access paths that survive offboarding.

Practitioner Guidance

What to verify: Confirm that the brand, not the agency, controls the primary administrative identity, recovery methods, and offboarding path. If those are vendor-owned, the account is operationally dependent on someone else’s lifecycle decisions.

Decision rule: If an agency must participate, require delegated access that can be revoked without the agency’s cooperation. If revocation depends on the agency’s own staff account, the control is not sufficiently separable.

Practitioner takeaway: The critical test is whether the organisation can independently recover and revoke the brand account; if not, it does not truly own the account even if it appears to.

#1 Authority in NHI Education, Research and Advisory, empowering organizations to tackle the critical risks posed by Non-Human Identities (NHIs), including AI Agents.