A common mistake is treating hygiene as a one-time cleanup instead of a continuous control. If teams delete accounts only when someone leaves and never recheck, stale identities, cached credentials, and open sessions can remain active long after they should be removed. That creates hidden exposure and gives attackers durable paths to exploit.
Why cyber hygiene fails when it is treated as a one-off event
cyber hygiene checks fail when organisations confuse cleanup with control. A one-time review can remove obvious accounts, but it does not catch identities that reappear through inherited access, dormant credentials, stale group membership, or sessions that outlive the original user. Good hygiene is a living process that keeps the access inventory aligned with reality.
Ghost users usually come from weak lifecycle discipline, not just missed deletions. If an account is disabled in one system but remains active in a SaaS app, directory sync queue, or delegated admin path, the organisation has not actually closed the access path. That is why visibility into service accounts, API keys, and other non-human identities matters as much as reviewing human joiner-mover-leaver records, as outlined in the Ultimate Guide to NHIs.
Stale access also persists because organisations review identity objects but not the material that proves access, such as cached tokens, certificates, and long-lived sessions. A clean user record does not mean the credential chain has been revoked. If the control does not cover the full access path, the attacker-facing exposure remains open even after the apparent cleanup is complete.
What organisations miss when they check accounts instead of access paths
The central mistake is narrowing the scope to named accounts. Real exposure lives in the relationships between accounts, roles, secrets, sessions, and delegated permissions. An identity can be “removed” on paper while an API key, service principal, shared account, or role assignment still grants the same effective authority. That is why hygiene must include discovery, inventory, rotation, and offboarding, not just deletion.
This is especially important where access is inherited or reused. A stale group, a forgotten application token, or an unmanaged automation account can keep producing access long after the original operational purpose has ended. The practical question is not whether the account exists, but whether anything can still authenticate, authorise, or delegate through it.
Visibility gaps make the problem worse. Teams often know the accounts they created, but not the ones created by integrators, legacy systems, or third parties. The most reliable sign of weak hygiene is when no one can produce a current, authoritative list of who or what still has access to production systems. NHIMG’s Key Challenges and Risks section is useful here because it ties stale access to visibility gaps, unmanaged credentials, and over-privilege rather than to simple account count.
One useful benchmark from the same research is that only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them. That tells you the failure is usually procedural, not just technical: many environments still depend on manual cleanup after the fact instead of enforced lifecycle control.
What good hygiene looks like in practice
Effective hygiene is continuous, evidence-driven, and scoped to the full access chain. Teams should revalidate access on a cadence, on change events, and after offboarding, then confirm that the removal actually propagates through directories, SaaS platforms, secrets stores, and session layers. A good check ends only when there is evidence that the access path no longer works, not when the ticket says the account was disabled.
- Review active accounts, roles, keys, tokens, and sessions together, not separately.
- Verify that revocation reaches downstream systems, including connected apps and delegated admin paths.
- Rotate or expire credentials that cannot be confidently tied to an owner or business purpose.
- Escalate any shared, dormant, or orphaned access that still touches production or sensitive data.
The strongest operational habit is to treat stale access as an exposure problem, not a housekeeping problem. If an identity or credential can still authenticate, the cleanup has not finished. For that reason, the OWASP Non-Human Identity Top 10 is a useful external reference because it frames secret sprawl, credential rotation, and over-privilege as structural hygiene failures, not isolated mistakes.
Practitioner Guidance: Prioritise proving revocation over proving deletion. The key control question is whether any stale identity, secret, or session can still reach a protected system after the supposed cleanup.
Practitioner takeaway: The organisations that avoid ghost users are the ones that measure access decay continuously, across accounts and credentials, instead of assuming that offboarding or cleanup once means access is gone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Inventory | Stale access often persists through unmanaged credentials and hidden access paths. |
| NHI-03 — Lifecycle and Offboarding | Ghost users are usually a lifecycle failure, not a simple deletion miss. | |
| NHI-05 — Visibility and Discovery | You cannot remove stale access if you cannot see all active identities and entitlements. | |
| Recommendation — Inventory all credentials, tokens, and keys that can still authenticate after account cleanup. Enforce offboarding and revocation checks whenever an identity, app, or integration changes. Continuously discover accounts, service identities, and entitlements across connected systems. | ||
| CIS Controls v8 | 5 — Account Management | Account hygiene requires authoritative tracking of who or what still has access. |
| 6 — Access Control Management | Stale access is created by lingering permissions, not just lingering usernames. | |
| 16 — Application Software Security | Session and token persistence can leave access active after user cleanup. | |
| Recommendation — Maintain a current account inventory and disable or remove inactive access promptly. Review and revoke permissions, roles, and inherited access on a recurring basis. Validate that applications revoke sessions and tokens when access is removed. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | The issue is the mismatch between identity state and effective access. |
| DE.CM — Continuous Monitoring | Continuous monitoring is needed to spot reintroduced or lingering access. | |
| RC.RP — Recovery Planning | Cleanup failures become operational incidents when access is left behind. | |
| Recommendation — Align identity records, authentication material, and access rights throughout the lifecycle. Monitor for dormant accounts, orphaned privileges, and unexpected access reuse. Document response steps for revocation failures and confirm restoration of a clean access state. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
