The Hidden Risk of Orphan Accounts

Orphan accounts—dormant user, service, and bot identities across applications and cloud consoles—pose a hidden risk as organisations grow and shed staff, contractors, and systems. The article explains that traditional IAM and IGA systems focus on human users and rely on manual onboarding, leaving non-human identities like NHIs and agent‑AI processes largely ungoverned, with little ownership or lifecycle control.

This creates a shadow layer of identities that are active but invisible to governance, described as part of the broader identity dark matter. Real‑world risks are highlighted, including breaches linked to an inactive Colonial Pipeline VPN account and a 2025 incident involving a ghost third‑party vendor account, with further context on the post‑acquisition surge in stale accounts.

The piece advocates continuous identity auditing—collecting application telemetry, maintaining a unified audit trail, and decommissioning inactive accounts—to close visibility gaps; Orchid's Identity Audit capability is presented as a practical example of this approach. According to Orchid Security, this article was written by Roy Katmor, its chief executive.