NHI Dormancy Detection is the process of identifying non-human identities that have not been used within an expected period. It relies on activity timestamps, login records, API call evidence, and related telemetry to separate truly inactive identities from ones that still authenticate through non-interactive channels.
Expanded Definition
NHI Dormancy Detection is the control practice of finding non-human identities that appear unused over a defined period so they can be reviewed, revalidated, or removed. In NHI operations, dormancy is not the same as irrelevance: an identity may show no interactive logins yet still authenticate through scheduled jobs, API calls, or workload-to-workload traffic. That is why teams must correlate timestamps, token use, service logs, and orchestration activity rather than rely on a single last-login field. This aligns closely with lifecycle management, visibility, and offboarding discipline described in the Ultimate Guide to NHIs, and it maps well to the identify and protect functions in the NIST Cybersecurity Framework 2.0. Definitions vary across vendors on how long an identity must be idle before it is considered dormant, so the threshold should be defined by system criticality, rotation cadence, and business dependency. The most common misapplication is treating “no human login” as proof of inactivity, which occurs when machine identities are monitored with human-centric audit rules.
Examples and Use Cases
Implementing dormancy detection rigorously often introduces operational friction, because false positives can interrupt batch jobs, integrations, or recovery workflows, requiring organisations to weigh reduced attack surface against service continuity.
- A CI/CD service account has not authenticated interactively for 120 days, but telemetry shows regular pipeline token use. The identity is not dormant; it is non-interactive and needs workload-aware monitoring, not deletion.
- An API key tied to a retired application shows no calls, no vault checkout events, and no rotation activity. That pattern supports decommissioning and aligns with the lifecycle approach in the NHI Lifecycle Management Guide.
- A cloud service principal stopped appearing in logs after an environment migration. Security teams compare cloud audit records with the activity model recommended in the Ultimate Guide to NHIs — What are Non-Human Identities before flagging it for removal.
- An orphaned certificate remains technically valid even though the associated workload has been shut down. Dormancy detection identifies the mismatch between credential validity and actual business use.
- A legacy integration account has no recent login record, but message queue telemetry proves periodic use from a container job. The account should be classified as active through non-interactive evidence.
For broader breach context, the 52 NHI Breaches Analysis shows how overlooked identity states can persist after application change, acquisition, or retirement.
Why It Matters in NHI Security
Dormant NHIs are attractive because they often retain permissions, secrets, and trust relationships long after operational ownership has faded. The result is a hidden attack path that may survive account reviews, especially when organisations only validate active human access. NHI Management Group’s Ultimate Guide to NHIs reports that only 5.7% of organisations have full visibility into their service accounts, which means dormancy checks are often performed with incomplete telemetry. That visibility gap matters because dormant identities can become compromise points when secrets are reused, applications are retired without offboarding, or certificates remain valid after the owning team has moved on. The control is also central to the operational reality described in Top 10 NHI Issues, where poor lifecycle hygiene repeatedly expands exposure. Organisations typically encounter the consequence only after an audit failure, incident review, or unexpected credential use, at which point dormancy detection becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Dormant NHI discovery supports lifecycle and ownership controls for non-human identities. |
| NIST CSF 2.0 | ID.AM-1 | Asset inventory controls depend on knowing which NHIs are active versus dormant. |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero Trust limits trust in dormant identities and their lingering access paths. |
| NIST SP 800-63 | Identity assurance principles inform how stale credentials and unused authenticators are handled. | |
| OWASP Agentic AI Top 10 | AGENT-03 | Agentic systems can leave dormant tool identities and credentials behind after workflow changes. |
Continuously verify NHI usage and restrict dormant identities from retaining implicit network trust.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
