Orphaned account

An orphaned account is live access with no living owner. The commonest source is offboarding that only went as far as the identity provider: the SSO login dies, but the SaaS account created with an email and password, the API key, the shared credential in a password vault: all keep working. The non-human version is subtler: the service account whose creator left, still running, still credentialed, with nobody who knows what breaks if it is revoked.

Why attackers love them

Orphaned accounts are the ideal foothold: real credentials, real access, and no user behind them to notice anything odd. Nobody reads their login alerts, nobody questions their activity, and no review reaches them if the review process starts from the current employee list. They are also pure waste: licences billed monthly for people who left last year.

Finding and closing them

The detection is a join: every account in every connected system, matched against a source of truth for who currently exists and works here. Accounts that match nobody, or match someone who left, are the orphan population. Ploy runs this join continuously across its integrations and reports the population as a posture segment on the identity security posture page, where the count is the point: it should be zero, and stay zero.