Why do dormant service accounts and ghost agents create governance risk?

Why dormant service accounts and ghost agents become governance problems

Dormant service accounts and ghost agents are a governance risk because they often keep working long after the business process, owner, or application that created them has been retired. That leaves access paths alive without an active accountable human, which weakens offboarding, review, and change control. The problem is not just unused access, it is unmanaged access with unclear purpose.

When a non-human identity outlives the project or workflow it supported, it can become invisible to normal control processes. A live credential, token, or key may still authenticate successfully, but nobody may know why it exists, who is responsible for it, or whether it should still be trusted.

Governance risk grows because these identities sit at the intersection of ownership, lifecycle, and privilege. Once ownership is lost, the organisation can no longer confidently answer basic questions such as who approved it, what it can reach, when it was last reviewed, and what event should trigger retirement or rotation.

What makes dormant identities hard to govern in practice

The core difficulty is that non-human identities are often created for integration convenience and then left behind after a migration, incident, team change, or automation rewrite. That is especially true for service accounts, shared automation credentials, and agent-like processes that were never tied cleanly to a named owner or expiry date. NHIMG’s Service Account Security Guide is useful here because it connects inventory, least privilege, and governance to the same object.

A dormant identity may still hold permissions that were sensible at creation time but are excessive today. In governance terms, the risk is not only that the identity exists, but that its access has not been revalidated against the current business need, data sensitivity, or trust boundary. The longer that gap persists, the easier it is for stale access to survive organisational change.

This also creates accountability drift. If a project is gone but the credential still works, normal access review processes can miss it unless the inventory is complete and ownership is explicit. NHIMG’s NHI Ownership and Accountability Guide is relevant because it treats ownerless identities as a lifecycle failure, not just an operational nuisance.

Why stale credentials and long-lived access preserve exposure

Dormant service accounts become more than paperwork problems when their credentials remain valid across systems, environments, or vendors. If a token, key, or password is still accepted, the identity can continue to authorize actions even if the original process has been decommissioned. NHIMG’s Guide to NHI Rotation Challenges is relevant because it addresses the operational reasons long-lived secrets persist.

The same pattern appears in real incidents where service credentials outlive the control assumption behind them. NHIMG’s Cloudflare Thanksgiving breach 2023 and Okta support system breach 2023 both show how unrotated or improperly handled non-human access can continue to matter long after the initial event or user action.

That persistence is why dormant identities are governance-sensitive even when they are quiet. They can preserve access into production systems, create hidden third-party dependencies, and undermine the assumption that unused access will naturally decay over time. In practice, “inactive” is not the same as “safe to ignore”.

Risk and Threat Considerations

Dormant service accounts and ghost agents create an exposure window because attackers often prefer identities that are trusted, overlooked, and still valid. A forgotten credential can provide a stable foothold, enable lateral movement, or let abuse blend into ordinary service traffic longer than a human account would.

Failure mechanism: The account or agent is no longer tied to an active business owner, but its secret, token, certificate, or downstream permissions remain live, so revocation never happens and review processes stop seeing it.

Impact: Exposure persists beyond the intended lifecycle, which can turn a retired process into an unmonitored access path for unauthorized actions, data access, or privilege abuse.

Practitioner Guidance

What to prioritise: Start with identities that have live production access, broad scope, or no clear owner. A dormant account with limited reach is a lower concern than one that can touch customer data, admin APIs, or cross-environment systems.

What to verify: Confirm three facts before treating an identity as acceptable to keep: who owns it, why it still exists, and whether the credential can still authenticate anywhere. If any one of those cannot be answered, treat the identity as a governance exception until proven otherwise.

Common mistake: Teams often inventory human users well but leave non-human access to drift between application owners, platform teams, and operations. The result is a gap between technical existence and governance ownership, which is exactly where ghost agents survive.

Practitioner takeaway: The control objective is not merely to find inactive identities, but to ensure every surviving non-human identity has a current owner, a justified business purpose, and an enforced end date or review cycle.

Related resources from NHI Mgmt Group

• Why do non-human identities create more audit risk than human accounts?
• When do service accounts become a higher risk than ordinary user accounts?
• Why do AI agents create more audit risk than traditional service accounts?
• Why do AI agents and service accounts create the same governance problem?