The Layoff Aftershock No One Talks About: The NHIs Left Behind

Just recently, Microsoft and Intel announced nearly 13,000 layoffs combined. Those headlines reignited conversations about workforce reductions, restructuring, and the human cost of automation and AI.

But beneath the noise lies a quieter, more persistent threat — one that doesn’t make headlines but endangers every organization that downsizes, merges, or reorganizes: the non-human identities (NHIs) that stay behind.

The Invisible Aftermath of Workforce Change

This pattern unfolds across companies of every size and sector. Employees leave, but their API keys, automation tokens, service accounts, and hardcoded secrets don’t. These digital fingerprints of their work often remain embedded across systems, repositories, and workflows — untouched, unmanaged, and dangerously over-privileged.

They become the hidden remnants of a former workforce — a perfect target for attackers.

What Happens to Secrets When Their Creator Leaves?

Developers and engineers create NHIs every day. A build script needs an access token. A pipeline gets a service account. A chatbot uses an API key.

Each of these NHIs plays a role in keeping operations running. But when the human who created them leaves — whether through layoffs, team shifts, or role changes — those identities rarely follow a formal offboarding process.

Their credentials continue to function, often with the same privileges. No rotation. No expiration. No owner. These orphaned NHIs live on long after their creators are gone — a silent inheritance that adversaries are eager to exploit.

Layoffs Aren’t the Only Trigger

Workforce reductions aren’t the only time NHI risk spikes. Mergers and acquisitions (M&A) introduce a second, often riskier, wave of exposure.

When one company acquires another, it inherits not just employees and assets — but every script, automation, and credential created over years of operations. That includes tens of thousands (sometimes hundreds of thousands) of NHIs and secrets, often with no clear ownership or purpose.

Questions pile up fast:

• Who created them?
• What do they access?
• Are they still in use?
• Are they even safe?

Without visibility and ownership attribution, these inherited NHIs become blind spots — unmonitored entry points that threat actors can weaponize, and auditors will inevitably flag.

The Data Is Clear: NHIs Outlive Humans

According to new research from Entro Labs, 1 out of every 1,000 NHIs in enterprise environments is over 10 years old. To put that in perspective, the average employee tenure is only 3.9 years (U.S. Bureau of Labor Statistics).

Humans leave. NHIs don’t.

They don’t give notice. They don’t retire. They don’t fade into the background.

They keep working — often with powerful privileges — long after their creators have logged out for the last time.

The New Mandate for Security Teams

As organizations undergo layoffs, restructuring, or M&A, their attack surface shifts dramatically. Security teams can’t afford to treat NHIs as an afterthought.

You need to know:

• What NHIs exist across your environments
• What secrets they use
• Which systems they access
• Who owns them — and if no one does, who should
• Which ones are idle, over-privileged, or risky

Without this visibility, dormant NHIs quietly expand your exposure — especially when your workforce is shrinking.