Score identity lifecycle hygiene from deprovisioning delay, orphan accounts and dormant identities across your estate.
Deprovisioning delay converts a leaver rate into a standing population of orphan accounts, in the same way arrival rate times service time gives queue length. The score penalises that population, the dormant tail and the delay itself, because a long delay is a risk even in a month with few leavers. Orphan and dormant accounts are the credentials nobody will notice being used — no owner to report a phish, no manager to spot the login, and frequently no MFA either.
Identity Lifecycle
orphan identities live at any moment = leavers per day × average deprovisioning delay, and each drags its application accounts with it.
Annual exposure
exposure = leavers per year × delay, expressed in account-days of unowned live access.
orphan identities live at any moment = leavers per day × average deprovisioning delay, and each drags its application accounts with it. Deprovisioning delay converts a leaver rate into a standing population of orphan accounts, in the same way arrival rate times service time gives queue length. The score penalises that population, the dormant tail and the delay itself, because a long delay is a risk even in a month with few leavers.
Orphan and dormant accounts are the credentials nobody will notice being used — no owner to report a phish, no manager to spot the login, and frequently no MFA either.
This calculator takes 6 inputs: Employees, Contractors and third parties, Leavers per month, Average delay from exit to disable, Application accounts per identity, Accounts unused past the dormancy threshold. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Same-day disable for employees and within the hour for involuntary terminations, driven by HR being the authoritative source rather than by a ticket. Contractors need an explicit end date on the account at creation, since nobody files a leaver ticket for a contract that simply lapses.
An orphan has no valid owner at all; a dormant account has an owner who has stopped using it. Both are unmonitored attack surface, but dormancy is also a signal for right-sizing — an account unused for 90 days usually indicates access that was never needed.