Ghost Profiles, Real Premiums: Preparing Identity Evidence for a 2026 Cyber Renewal

A cyber renewal in 2026 is less a questionnaire than an evidence exercise. Underwriters serving UK organisations, including Lloyd's syndicates and regional insurers, now ask not only whether multi-factor authentication is enforced but whether the identities it protects are still required. Dormant accounts are an awkward blind spot: they generate little operational noise, often sit outside daily ownership, and survive because removal carries no obvious reward. The result is a silent seat at the table - an identity with access but no active purpose.

The underwriting signal in a stale identity

Insurers use identity hygiene as a proxy for control maturity. A stale administrator account, a shared mailbox still accessible to a former contractor, or a test profile with production rights suggests that joiner-mover-leaver processes exist on paper but are not consistently applied. That matters because many cyber incidents begin with credentials that should no longer work. Underwriters are not usually looking for a perfect estate; they are looking for a repeatable process, clear ownership and evidence that exceptions are understood.

For UK decision-makers, the practical question is therefore not simply "how many dormant accounts do we have?" It is "can we show how we find them, decide what to do, and prevent them from returning?" A one-off clean-up may satisfy a checklist, but it rarely satisfies a renewal conversation.

Agree a definition that can survive scrutiny

Last sign-in is a starting point, not a verdict. Some accounts authenticate through synchronisation tools, some are used only by automated processes, and some remain intentionally idle as break-glass access. Before searching, agree a written definition of dormancy and distinguish between human identities, service accounts and privileged accounts.

A workable baseline for many UK organisations is an interactive account with no sign-in for 90 days, no assigned business owner, no active mailbox or alias, and no documented business process. Risk tiers can then extend the threshold to 30 or 180 days depending on privilege and data access. Record the definition in policy and have it approved by both security and data protection leads. UK GDPR data minimisation and retention principles should inform how long identity records and audit exports are kept, particularly where they contain personal data.

Reconcile three inventories

A credible audit draws on at least three sources. Start with the directory - Microsoft Entra ID or on-premises Active Directory - and export account status, creation date, last interactive sign-in, privilege level and owner attributes. Next, interrogate SaaS administration consoles for accounts that may sit outside directory sync. Finally, review line-of-business systems: finance, HR, practice management, logistics and customer platforms often hold local accounts that never appear in central reports.

Reconcile those exports against HR leaver lists, contractor registers and payroll changes. Use read-only exports with timestamps so the evidence can be reproduced. A simple working table should include the identity, system, account type, last activity, owner, business justification and proposed action. Do not rely on a single source. A synced account may show recent activity generated by automation rather than a person, while a local account may be genuinely dormant but invisible to the directory team.

Triage exceptions before taking action

Not every dormant identity is disposable. Service accounts may support overnight processing. Break-glass accounts may be deliberately unused. Shared mailboxes may serve a statutory or customer-facing purpose. Vendor support accounts may be contractually required. Test and training profiles may need to remain available for controlled periods.

For each exception, assign a named owner and a review date. Convert interactive service accounts to managed identities where possible, remove interactive sign-in rights, and restrict privileged dormant accounts to a documented emergency process. Record the rationale. Underwriters are more likely to accept a small number of explained exceptions than a large number of unexplained accounts.

Remediate in controlled waves

A purge creates operational risk. A wave-based approach is easier to defend. The first wave should cover leavers older than 30 days, accounts with no owner and no mailbox, and duplicate identities. The second can address stale contractor accounts and local line-of-business profiles. The third should handle service-account rationalisation and privileged access clean-up, which usually requires more testing and change control.

Notify service owners before disabling accounts, maintain a rollback route and measure the time taken to disable an identity after approval. For leavers, reconcile against HR and payroll records rather than relying on manager emails. For contractors, use contract end dates and sponsor confirmation. The aim is not to remove access aggressively but to make access decisions visible and repeatable.

Produce an evidence pack, not a data dump

Underwriters need a concise narrative supported by evidence. A renewal pack should include the dormancy policy, the audit method, inventory sources, counts by system and risk tier, sample remediation records, a list of retained exceptions with owners, and an attestation from the accountable executive. Redact personal data where it is not necessary and use pseudonymised identifiers for samples.

A short trend statement is more persuasive than a raw spreadsheet: how many dormant accounts were identified, how many were disabled or removed, how many exceptions remain, and what changed in the process. If the organisation has only just started, say so and show the quarterly plan. Insurers generally prefer an honest baseline with a credible cadence to an implausible claim of zero dormant accounts.

Make the audit a quarterly discipline

A single clean-up decays. Set a quarterly cadence that aligns with access reviews and the renewal calendar. In the first month, refresh inventories and reconcile HR data. In the second, triage exceptions and remediate approved accounts. In the third, attest results and report a small set of metrics to the board risk committee or audit committee.

Useful measures include the number of dormant accounts by system, the percentage with a named owner, the average time from leaver date to disablement, and the number of exceptions past their review date. Start at least 90 days before renewal so that evidence reflects a completed cycle rather than an aspiration. For UK organisations facing pointed identity questions in 2026, the silent seat is best addressed before the underwriter asks who is sitting in it.