In 2022, someone at Klue created a service credential for a test integration that was never shipped. The integration was abandoned, but the credential stayed active.
On June 11 2026, the Icarus extortion group used that forgotten credential to access Klue. The attackers stole OAuth tokens connected to Klue’s customers and used them to enter dozens of corporate Salesforce environments, including LastPass. We explained the full attack chain and ATT&CK mapping in LastPass 2026: When Your Password Manager Gets Breached (Again).
The attackers did not need a zero-day vulnerability, malware, or a phishing email. A forgotten credential was enough to expose customer data. That is the focus of this article: not how attackers bypass authentication, but how organizations leave behind active accounts, tokens, and credentials that nobody tracks or remembers to remove.
1. Residual Access, in Numbers
A local password can continue working in a non-SAML application. An OAuth refresh token can preserve access without another interactive login, or a shared credential may still be known by the former employee.
These are residual accounts: accounts, credentials, sessions, and delegated authorizations that remain usable after the person, role, project, or integration they belonged to should have been removed. When ownership can no longer be tied to an active user or legitimate business need, they become orphan accounts.
The Cloud Security Alliance’s 2025 SaaS security study, based on responses from 420 IT and security professionals, found that 54% of organizations lacked automation for lifecycle management. The same research found that 55% of employees adopt SaaS without security’s involvement and 57% of organizations report fragmented SaaS administration – exactly the conditions that make complete offboarding difficult.
Large workforce studies show the downstream result. In 1Password’s 2025 survey of more than 5,000 knowledge workers, 52% said they download apps without IT approval.
Tailscale’s 2025 survey of 1,000 IT, security, and engineering professionals reported an even wider access-control gap: 68% of workers retain network access even after leaving an organization.
All these surveys point to the same structural failure: organizations frequently remove the employee from the directory without removing every path that the employee – or an attacker using the employee’s credentials can still use.
Stolen credentials, phishing, and other human-centered techniques are still among the most frequent breach causes. Residual accounts make credential-based access particularly dangerous because the authentication can appear completely legitimate – a real password, from a real account, with no MFA prompt to flag it. Closing that specific gap, a legitimate-looking credential nobody remembered to revoke, is exactly what Unixi is built to solve.
2. Why Disabling the IdP Account Is Not Enough
Modern SaaS access is a graph, not a single login. A corporate identity can connect to dozens of applications through SAML, passwords, social identity providers, OAuth grants, shared accounts, API tokens, recovery addresses, personal browser profiles, and persistent sessions.
Traditional offboarding often affects only the central identity-provider node. Any connection not governed by that node can survive.
- Local Authentication Bypasses – An application may support SSO while continuing to allow direct username-and-password authentication. Disabling the employee in the IdP blocks the federated route, but the legacy password remains valid.
- Persistent Sessions and Tokens – Session cookies, OAuth refresh tokens, API tokens, and SaaS-to-SaaS grants may continue authorizing requests until they are explicitly revoked or expire, depending on the application and identity provider.
- Shadow SaaS Accounts – Employees can register applications directly using corporate email addresses, often outside procurement, security, and IT workflows. When the employee leaves, the IdP account may be disabled, but IT may not even know that the downstream SaaS account exists. Security cannot deprovision an identity it never discovered.
3. Setting the Baseline: Credential Abuse in 2026
Passwords don’t fail because they’re weak. They fail because they’re portable. A password works from any device, for anyone holding it, until someone rotates it. Every number below is a downstream consequence of that one property.
| Finding | Source |
|---|---|
| Credential abuse appears in 39% of breaches across the full attack chain (13% as initial access, down from 22%) | Verizon DBIR 2026 |
| 73% of ransomware victims had an infostealer infection or credential leak in the year before the attack; 50% of those within 95 days | Verizon DBIR 2026 |
| T1555 — Credentials from Password Stores appeared in 23.49% of 15.5M adversarial actions mapped from 1.08M malicious files | Picus Red Report 2026 |
| 11.1M devices infected by infostealers in 2025, feeding a pool of 3.3B+ credentials, session cookies and cloud tokens | Flashpoint 2026 GTIR |
| 41% of successful human logins on Cloudflare-protected sites used a previously-leaked password | Cloudflare, Mar 2025 |
| Of 19.03B passwords exposed in 2024–2025 leaks, only 6% were unique | Cybernews, May 2025 |
4. Coverage and SSO Tax
A vault typically reaches 15–30% of the app adoption, and usage stays optional the whole way, and nothing stops a user from reusing a weak password instead. Your IdP reaches about 21% of the stack – Zylo’s 2026 index and Push Security’s browser telemetry both land near 1 in 5. On the other hand, Universal SSO (Unixi KDA) inverts that relationship: authentication is enforced rather than offered, across 100% of apps.
Meanwhile the actual surface:
43% of security incidents now involve shadow AI – unsanctioned tools adopted without IT sign-off, more than double the 20% recorded a year earlier. More than two-thirds of breached organizations had no governance process to detect it, and only 38% require IT approval before an AI tool is deployed (IBM).
Gartner projects 75% of employees will acquire, modify or create technology outside IT’s visibility by 2027, up from 41% in 2022
Your IdP covers the SAML tier. Your password manager covers whatever users chose to save. Neither covers the intersection that actually matters: corporate identity, non-SAML application, no visibility, no revocation path.
And the SSO tax makes that gap economically rational for the business unit that created it. The app supports SAML – on a tier procurement won’t approve. So the team signs up with a password, and now it’s in the 43% (from the IBM statistic above).
Most SaaS vendors gate SAML behind an enterprise tier, and the markup is not proportional to the cost of supporting it:
| App | Base | With SSO | Increase |
|---|---|---|---|
| Github | $4/user/mo | $21/user/mo | 425% |
| Airtable | $20/user/mo | $45/user/mo | 125% |
| Calendly | $12/user/mo | $25/user/mo | 108% |
The real expense of supporting SAML is one-time integration work plus maintenance labor, not per-user infrastructure. This is where the budget problem becomes a security problem.
Unixi removes the SSO tax from the equation, because no application has to be upgraded to unlock federation. The app is never asked to support SAML, never integrated with the IdP, and never moved off the tier you actually need. Coverage stops being a per-app purchasing decision.
5. How Unixi Closes the Gap
Every problem above has one thing in common: authentication happens in places the identity provider cannot see, and revocation happens in places it cannot reach. Unixi addresses both through its core four pillars.
Discovery
Security cannot deprovision an identity it never discovered. Because Unixi observes authentication at the browser layer, it sees the applications employees actually log into rather than the ones procurement recorded: unmanaged apps, SAML apps, shadow SaaS, shared accounts, weak and reused passwords, and cases where users are bypassing SSO that already exists.
Risk Analysis
Discovery finds the accounts. Risk Analysis decides which ones matter. An inventory of 300 applications is not a remediation plan, and not every forgotten account is equally dangerous. The Klue credential sat unused for four years before anyone weaponized it; most orphaned accounts never get discovered by an attacker at all. Risk Analysis ranks discovered apps and accounts by how much damage they could do if found: which ones are orphaned with no owner, which touch sensitive data, which share a credential with another still-active account, and which sit entirely outside the IdP with no revocation path at all. That ranking is what turns a list of 300 unknowns into a prioritized list of the ones worth fixing first.
Universal SSO (uSSO)
The password manager section came down to one property: a vault is a copy of credentials, and Unixi removes the need for that copy. Authentication runs on Key Derived Authentication (KDA). KDA builds each login from multiple keys stored in multiple locations, and it generates the authentication material fresh every session. Nothing gets stored.
Read more about how the SSO surface works →
This design removes two risks at once: there’s no vault to steal, and no shared secret an employee can carry with them after offboarding. A forgotten password can survive for years – someone can still remember it, write it down, or reuse it elsewhere. The Klue credential proves four years isn’t even a stretch. A derived key can’t do that. It never existed as something to remember in the first place.
Lifecycle Management
Section 1 gave the two halves of this problem: 54% of organizations have no lifecycle automation, and 68% of workers retain access after leaving. Both figures describe the same missing link: the termination event and the revocation event are separate events.
Unixi closes that gap by sitting on the other side of it: the IdP only has to integrate with Unixi once, via SAML and SCIM, and Unixi extends that single signal down into every application it governs, SAML-compliant or not.
With SAML and SCIM integration to the IdP, disabling a user in the directory revokes access across every Unixi-governed application in real time. Termination becomes revocation.
