Jerome Thorstenson on Orphaned Accounts | Identity Fabric Impact Day Speaker Spotlight

Orphaned accounts are described as ideal hiding spots for attackers: they retain access but lack an active owner who would notice misuse, making them attractive for credential stuffing, phishing, and ongoing abuse. With emerging regulatory pressure such as NIST 2 and DORA, unmanaged orphaned accounts are positioned as likely drivers of future breach headlines, so allowing them to persist creates unnecessary organizational risk. Real-world examples include a contractor account still holding admin rights inside a production payment processing system because an HR feed failed to disable it, and legacy service accounts tied to long-forgotten applications that continued running batch jobs using credentials nobody remembered or could justify—effectively “ghost processes” found by accident.

True visibility is framed as knowing each account’s owner, last use, purpose, connected systems, and the risk if compromised, achieved through correlating identity and access data across HR, directories, SaaS applications, and service-account use cases. The central failure mode is pretending these accounts don’t exist; instead, identification requires close coordination with stakeholders and ensuring every account has a real accountable human owner. Mitigation includes applying MFA where appropriate or implementing compensating access controls for legacy constraints, plus using Privileged Access Management so shared credentials are checked out rather than informally distributed. A practical cleanup approach starts by defining “orphan account” for the organization, setting inactivity thresholds, agreeing on a deprovisioning process, and then systematically scanning systems like Active Directory or Entra ID to find and remediate accounts that exceed those thresholds.

• Orphaned accounts are prime targets for credential stuffing, phishing, and abuse due to the absence of an active owner.
• A contractor account was found inside a production payment processing system.
• The contractor account retained admin rights because an HR system feed did not disable it.
• Orphaned service accounts remained tied to older applications while still running batch jobs.
• Some batch jobs continued running even though no one remembered why they existed or why they used specific credentials.
• “True visibility” includes knowing account ownership, last use, purpose, connected systems, and risk if compromised.
• Correlating identity information across HR systems, directories, SaaS applications, and service accounts is part of achieving visibility.
• Implementing Privileged Access Management enabled shared credentials to be checked out instead of informally distributed.
• Identifying orphan accounts can involve traversing Active Directory or Entra ID and flagging accounts outside defined thresholds.
• A deprovisioning process is required to prevent unused accounts from lingering indefinitely.

• “An orphaned account is kind of like a security camera with the lens taped over it.”
• “It exists. It has access, but nobody’s watching.”
• “They’re prime targets for credential stuffing, phishing, and abuse because there’s no active owner to raise a flag.”
• “So letting them linger is risky.”
• “I found a contractor hidden inside our production payment processing system.”
• “It still had admin rights because [the] HR system feed hadn’t disabled that particular contractor.”
• “They basically turned into ghost processes that we kind of stumbled on… by accident.”
• “True visibility looks kind of like you know who the owner of the account is, when it was last used, what it actually does.”
• “Step one is don’t pretend they don’t exist.”
• “The shared credentials were checked out and we didn’t pass around any passwords or certificates.”