Accounts belonging to employees who have left the organization but were never disabled or deleted. These are frequently targeted by attackers because they have no active owner who would notice anomalous activity. Manual offboarding processes almost always leave gaps.

Accounts that have effective admin privileges through indirect group memberships, ACL delegations, or GPO permissions — without being in any obvious "Admins" group. These are invisible to standard account audits and represent one of the most dangerous blind spots in Active Directory environments.

Service accounts are created as applications are deployed, but rarely cleaned up when apps are decommissioned. They often have static passwords, excessive permissions, and no owner. Many are also used interactively by humans, bypassing intended controls and creating significant audit risk.

SSH keys, API tokens, OAuth credentials, and cloud service principals are frequently created by developers and never tracked centrally. They may grant powerful access, never expire, and live in source code, container images, or configuration files where they can be exfiltrated.

Unlike periodic scans, CID continuously monitors identity stores and endpoints for new accounts, permission changes, and anomalies — in real time. It operates agentlessly, scanning Active Directory, cloud directories, and endpoints without requiring software installation on each system. This means new accounts are discovered within minutes of creation, not during the next scheduled audit.

CID doesn't just list accounts — it maps the full web of relationships: group memberships, ACL delegations, SPN assignments, trust relationships, and effective permissions. This surfaces shadow admins and privilege escalation paths that are invisible in raw account listings. You can see exactly how an account can become an admin, even through a chain of indirect memberships.

Each discovered identity receives an automated risk score based on factors like: stale/inactive status, privilege level, whether credentials are in the vault, password age, exposure in cloud vs. on-prem, and anomalous behavior indicators. This allows security teams to prioritize remediation rather than drowning in undifferentiated alerts.

When CID discovers an unmanaged privileged account, it can automatically trigger a workflow to enroll the account in the Delinea vault, reset its password, assign an owner, and begin managing its lifecycle — without manual intervention. For accounts that can't be immediately vaulted, CID raises a ticket in ServiceNow, Jira, or other ITSM tools to track remediation.

CID specifically targets the explosion of non-human identities: service accounts, API keys, OAuth tokens, managed identities, service principals, and certificates. It tracks their usage, ownership, expiry, and privilege level — and flags those that are over-privileged, unused, or about to expire before they become a security gap or operational incident.