Dormancy Signal

Expanded Definition

Dormancy signal is the security value created when a service account, API key, or other NHI shows a long period of no authentication or no meaningful activity, then suddenly becomes active again. The signal is not the dormancy itself, but the contrast it creates against normal behaviour. In NHI operations, that contrast helps defenders spot anomalous use, stale credentials being revived, or an account that has been quietly retained long after its original purpose ended.

Usage in the industry is still evolving. Some teams treat dormancy as an alerting heuristic, while others fold it into lifecycle governance, offboarding, or continuous access review. NIST controls on account monitoring and least privilege support the broader principle that identity activity should be observable and justified, even when the identity is non-human. For practical NHI governance, dormancy becomes most useful when paired with ownership data, expected cadence, and secret rotation history, as described in the Ultimate Guide to NHIs and the NIST SP 800-53 Rev 5 Security and Privacy Controls.

The most common misapplication is treating dormancy as proof of safety, which occurs when teams assume an inactive account is harmless instead of verifying whether it is still provisioned and capable of access.

Examples and Use Cases

Implementing dormancy signals rigorously often introduces a tradeoff between detection fidelity and operational noise, requiring organisations to weigh faster anomaly discovery against the effort of maintaining accurate ownership and usage baselines.

• A CI/CD service account has not authenticated for 120 days, then suddenly starts issuing token requests from a new region. The dormant-to-active shift becomes a high-signal investigation trigger.
• An API key embedded in an internal application is unused for months, then appears in access logs after a repository change. The dormant credential may indicate reuse, leakage, or delayed cleanup.
• A batch-processing NHI normally runs every night, but misses its expected schedule for weeks and later resumes with elevated access. The mismatch between expected cadence and resumed activity exposes a review point tied to lifecycle control.
• An old cloud role remains provisioned after an application is retired. Later authentication attempts against that role reveal that offboarding never completed, which is exactly the kind of issue covered in the Ultimate Guide to NHIs.
• Security teams baseline dormant accounts against expected control patterns in NIST SP 800-53 Rev 5 Security and Privacy Controls, then route exceptions for manual validation instead of automatic trust.

In mature environments, dormancy signals also support investigations into secret sprawl, because unused identities often persist long after their embedding application or integration has changed.

Why It Matters in NHI Security

Dormancy matters because compromised NHIs often evade notice precisely by waiting. A credential that has been silent for months can look legitimate when it finally reappears, especially if ownership, expected use, and rotation records are incomplete. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, which means dormant identities are frequently harder to classify than actively used ones. That visibility gap makes dormant accounts a governance problem, not just an anomaly-detection problem, as highlighted in the Ultimate Guide to NHIs.

Practitioners should treat dormancy as an operational clue that helps prioritize review of stale secrets, forgotten automations, and unowned access paths. The point is not to alert on inactivity alone, but to understand why an identity went quiet, whether it should still exist, and what controls should re-apply before it acts again. That is why account monitoring, revocation discipline, and periodic access review all reinforce the same control objective in NIST SP 800-53 Rev 5 Security and Privacy Controls.

Organisations typically encounter the real impact only after a dormant credential is reused in an intrusion or audit, at which point dormancy signal becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• When should teams treat missing enrichment as a priority signal?
• Why do single-signal controls fail for agentic AI security?
• What breaks when provenance attestation is treated as a complete trust signal?
• Signal Sharing