Identity Due Diligence: Managing Non-Human Identity Security in M&A

Ofer Sivan

No items found.

Identity Due Diligence: Managing Non-Human Identity Security in M&A

The Hidden Chaos & Risk of M&A

Mergers and acquisitions (M&As) are among the most exciting events an enterprise can experience. At the same time, they can be among the most critical and complex. While leadership celebrates and focuses on strategic alignment and financials, a less visible, but highly consequential, challenge lies in the tangled web of Non-Human Identities (NHIs) that span both organizations. Research showed that nearly 46% of organizations have experienced breaches related to non-human identities, with the average enterprise suffering 2.7 incidents in the past year.

NHIs, including service accounts, automation scripts, CI/CD tools, and machine-to-machine integrations, outnumber human users by a staggering 45:1 ratio. These NHIs often carry elevated privileges and persist long after their human owners have left.

During an M&A, the convergence of two technology ecosystems compounds the risks, creating blind spots ripe for exploitation. This is where identity due diligence becomes not just a best practice, but a security imperative.

Here are five key identity-related security risks to consider during the M&A process.

Case Study: Google’s Acquisition of Wiz

Wiz has ~1,800 employees. Over the past five years of Wiz operations, thousands of person-years have been spent coding, utilizing a variety of technologies, resulting in an immense amount of NHIs. It’s a real challenge to identify these NHIs across so many technologies and so many people over long periods of time.

Managing human and non-human identities becomes a real challenge once the merger becomes a reality.

The IT and security integration team must ask key questions, such as:

Which NHIs exist and who owns them?
Which of these NHIs pose the most significant risk?
Will ownership of NHIs change post-acquisition?
In the era of IaC, which code is responsible for creating these NHIs?
Which identities are unmanaged workloads?
Which NHIs have privileged access?
What happens to former employees’ NHIs?
Are machine identities properly tracked?
Are there any identity risks with third parties?
How many shadow NHI accounts exist?
Which NHIs are no longer needed?

1. Orphaned Accounts: The Silent Backdoor into Merged Environments

Orphaned accounts are one of the most persistent threats post-acquisition. These are identities, often non-human, that remain active even after their human owners have left. During M&A integration, it's common to discover thousands of stale tokens and accounts with lingering access to critical systems.

A recent study found that 91% of former employee tokens remain active. Worse, 31% of companies have seen assets accessed after termination. Without a method to identify and deprovision these accounts, organizations are vulnerable to data leaks, compliance violations, and insider threats. Clear attribution and ownership must be enforced before integration begins.

2. NHI Lifecycle Management: Secrets That Outlive Their Owners

NHIs are notoriously hard to manage. Secrets, tokens, API keys, and machine credentials often live outside traditional IAM systems, with poor or nonexistent rotation policies.

During an M&A, two fragmented identity ecosystems collide, exacerbating sprawl. Research found that 70% of GitHub secrets leaked in 2022 are still active. This pattern likely holds across Salesforce, AWS, Snowflake, and other SaaS environments.

Without lifecycle management, attackers have ample time to exploit unmanaged credentials. A centralized view is critical to enforcing rotation policies, cleaning up unused access, and detecting drift.

3. Shadow Identities: The Breach You Don’t See Coming

Shadow identities—accounts that are unmonitored or unknown—are rampant in post-M&A environments. These include unused service accounts, or employee-created automation scripts that fly under the radar.

This problem is only getting worse in 2025: NHIs are being provisioned at scale, allowing autonomous agents and LLMs to interact with each other. Many of these agents need NHIs for their operations, leading to orphaned NHIs that no one knows about or manages.

These identities are vulnerabilities, not just oversights. Shadow AI compounds the problem, enabling autonomous creation of new unmonitored identities. A single unprovisioned account provides an entry path for attackers to launch a full-scale breach. In fact, 90% of organizations experienced at least one identity-related incident in the past year.

Token Security provides attribution for every NHI, helping security teams detect, trace, and deprovision unowned identities before they are exploited.

4. Excessive Permissions: Hidden Power in the Wrong Hands

Excessive permissions are another hidden threat in nearly all mergers, especially among cloud identities. Data from the 2024 Tenable Cloud Risk Report revealed that 23% of cloud identities have high-severity or critical privilege levels.

Mapping who has access to what across SaaS, IaaS, and hybrid environments is always difficult. Doing it during a merger is nearly impossible, especially without automation. At the same time, granular enforcement of least-privilege access is essential. Otherwise, you risk leaving misconfigured permissions and toxic combinations of access unnoticed in the combined entity.

Security teams must assume breach posture and prioritize permission audits early in the integration process.

5. Authenticating NHIs: A Machine-First Security Imperative

Traditional authentication models and technologies, such as MFA, SSO, IAM, are designed for humans, not NHIs. Machine identities act independently, often without manual approval or oversight, don’t leverage MFA or biometrics, yet are granted sweeping access privileges.

Managing NHIs requires a machine-first identity security model—built around attribution, behavior analysis, and autonomous risk scoring. Token Security enables this approach, delivering full visibility, control, and policy enforcement across every identity in the system.

Solve the NHI Identity Crisis with Token Security

M&As are a breeding ground for identity risk. Non-human identities, in particular, demand special attention due to their scale, privilege levels, and persistence.

Token Security provides the clarity and control you need to navigate identity chaos. With real-time discovery, ownership attribution, and actionable insights, Token enables a secure and confident transition from due diligence to integration.

Don’t wait until the breach happens. Secure your M&A from day one with Token Security.

→ Schedule a demo today and protect what matters most.

‍