I see dead people: the ghosts running your organisation, and the one in your mirror
At 5am on 7 May 2021, someone at Colonial Pipeline found a ransom note on the company’s IT network.
By the end of that day, the largest fuel pipeline in the United States had stopped. All 5,500 miles of it. For 5 days it moved nothing, and petrol stations across the US south-east ran dry.
The attackers got in through a VPN account.
An old one. It had a long, complicated password and no multi-factor authentication. And when CEO Joseph Blount gave evidence to the US Senate a month later, he admitted the worst part: his IT team hadn’t known the account existed. It didn’t show up on any of their scans.
Colonial paid 75 bitcoin, about $4.4m at the time. The US Justice Department later recovered around $2.3m of it.
Colonial took IT seriously on paper. Blount told senators the company had invested more than $200m in its IT systems over the previous 5 years. That money protected the systems people knew about.
Everyone at Colonial thought that account was dead. The account didn’t get the memo.
You know the line from The Sixth Sense. A small boy whispers it to his psychologist, and it’s been a meme for 27 years.
The bit people forget is what he says next. The dead walk around like everyone else. They don’t know they’re dead. They only see what they want to see.
I’ve spent 25 years in IT, across banks and UK government departments, and every organisation I’ve worked in has been haunted like this. Dead accounts with live passwords. Servers that do nothing except cost money. Meetings that outlived their purpose by 3 reorganisations. Skills that died while people were still using them.
For about 2 years, one of those ghosts was me.
Your leavers are still logged in
In 2017, identity firm OneLogin surveyed 500 IT decision makers in the US. Nearly half (48%) knew of former employees who could still get into company systems. A quarter took more than a week to remove a leaver’s access. And 1 in 5 said a missed leaver had contributed to a data breach.
The view from the other side is worse. In a 2023 PasswordManager.com survey of 1,000 US workers, 58% said their old company passwords still worked after they’d left. Most of the people who used them did it for personal reasons, like reading their old email. About 10% said they were trying to disrupt their former employer.
The cause is dull, which is exactly why it survives. HR owns the leaver process. IT owns the accounts. Service accounts and API keys belong to whoever created them, and that person left in 2019. Every handover between those groups is a gap a ghost can slip through.
Contractors are a hard case. I’ve been one for most of my career, and contractors often leave without going through the same leaver process as permanent staff, because half the paperwork sits with an agency.
Machine identities are scarier still. A human leaver at least triggers an email to someone. A service account has no line manager, no notice period and no leaving drinks. It just keeps its keys.
(This applies at home too. Your ex probably still has your Netflix password.)
The action: Pull HR’s leavers list for the last 12 months and compare it with the active accounts in your identity provider. In AWS, aws iam generate-credential-report gives you the last-used date for every access key. Anything untouched for 90 days gets a named owner or a deletion date.
A quarter of your servers are already dead
In 2015, Jonathan Koomey (then a research fellow at Stanford) and Jon Taylor of the consultancy Anthesis studied 4,000 servers across 5 data centres. 30% were comatose: switched on, drawing power, and doing no useful work for at least 6 months.
They ran it again in 2017 with 16,000 servers. The figure for physical servers had dropped to 25%. Virtual machines came in at 30%.
The security angle sits in the small print. The researchers called these machines an underrated security risk, and the reason is obvious once you say it out loud: no one patches a server they’ve forgotten about.
Cloud was supposed to fix this. In my experience it made ghosts cheaper to create and easier to forget. Spinning up an instance takes 2 minutes. Getting anyone to admit they own it 2 years later can take a month of emails.
On migrations, the moment I’ve learned to dread is finding a box that no one will claim. You switch it off, and 1 of 2 things happens. Nothing at all, or payroll fails on the 28th.
To be fair to the owners, some idle boxes are idle on purpose. A disaster recovery standby, or a server that only wakes up for year-end close, looks dead for 11 months of the year. So before anything gets switched off, check the calendar for quarter-end, year-end and DR test dates.
A server no one owns is a server no one patches.
The action: Tag every resource with a named person as its owner. Anything with no owner and no traffic for 90 days gets a scream test: stop it, leave it stopped for 30 days and see who shouts. If the answer is no one, delete it.
The report that outlived its reader
Some of the most expensive ghosts live in your calendar.
Every team I’ve joined has had one. A weekly status report, built years ago for a director who has since moved on. Someone still spends 3 hours every Friday putting it together. It goes to a distribution list, and as far as anyone can tell, it’s read by the distribution list.
Meetings work the same way. A recurring call gets set up for a project in 2022. The project ends. The call carries on, because cancelling it feels rude and turning up only costs an hour. Multiply that hour by 8 people and 50 weeks, and you’ve spent 400 hours a year holding a séance.
The odd thing is how hard these are to kill once they exist. Cancelling a meeting someone senior set up feels like a political act, so people keep turning up out of politeness. The cost is spread so thinly that no single person ever feels it.
These rituals survive for the same reason the Colonial VPN account did. Creating something is a decision. Leaving it running is the absence of one.
A habit has no expiry date unless someone writes one in.
The action: Pick 1 recurring report or meeting you own. Skip it for 2 cycles. If someone asks where it went, you’ve found its reader. If no one does, you’ve got the time back. (Check first for anything regulatory. Some reports exist for an auditor who only looks once a year.)
Skills die before the people using them notice
In October 2017, Larry Ellison stood on stage at Oracle OpenWorld and launched the Autonomous Database. He said it would provision, patch, update and tune itself with no human involved. Oracle’s own announcement said it removed the human labour of running a database.
I was an Oracle DBA. That labour was my job.
I’d spent years getting good at it. Reading wait events. Rebuilding indexes at 2am. Knowing which parameter to touch and which to leave well alone. It was a craft, and I was proud of it.
Ellison overstated it (keynotes do), and DBAs still exist. What changed was where the work lived. Tuning I’d been proud of turned into a setting in a cloud console. And for a while I kept doing things the old way, explaining away every clue that the ground had shifted under me.
The World Economic Forum’s Future of Jobs Report 2025 surveyed more than 1,000 employers across 55 economies. They expect 39% of workers’ core skills to change by 2030.
That’s roughly 2 in every 5 things you’re good at today. Some of them are probably ghosts already. You just haven’t noticed yet.
A ghost skill is one you’re still proud of after a machine has taken it over.
The action: Write down 5 things you were praised for at work 5 years ago. Next to each one, write who or what does it now. Any line where the answer is “a tool” or “the platform” is a skill to retire, and the hours it frees up go on whatever you learn next.
Seniority is where ghosts hide
This is the claim I expect pushback on: the more senior you are, the more likely you are to be one of the dead people.
Spoiler for a 27-year-old film. In The Sixth Sense, the psychologist has been dead since the opening scene. He spends the whole film explaining away the evidence. His wife won’t speak to him, so he decides she’s angry with him. People look straight past him, so he decides they’re busy.
Senior people do exactly this. A junior engineer who’s out of date gets corrected in code review within a week. A senior engineer who’s out of date gets nodded at. The design review invites quietly stop arriving. The hard questions start going to the newer person. And the senior person decides everyone’s just busy.
I’ve watched this happen to people I respected. I’ve caught it happening to me.
There’s a decent counter-argument, and it deserves a fair hearing. Senior people have seen more failure, and pattern recognition from 3 previous outages is worth a lot. The trouble starts when those patterns come from systems that no longer exist.
Experience is a real asset. It’s also the best camouflage a ghost could ask for, because a long CV makes it very easy to believe you’re still current.
The fewer people correct you, the less you know about whether you’re still alive.
The action: Ask 1 junior colleague this week: “What do I do that looks old-fashioned to you?” Write the answer down. Don’t defend any of it for 24 hours.
Most organisations only hunt ghosts after one bites
Before May 2021, US pipeline security guidance from the Transportation Security Administration was voluntary. 20 days after the Colonial attack, the TSA issued an emergency directive: the first mandatory national cyber security rules the pipeline sector had ever had. A second directive followed that July.
That’s the usual order of events. Something dies (in this case, a pipeline), and then the audit happens.
I’ve seen the same sequence in banks and in government. The access review that only gets funded after a penetration test report lands on the wrong desk. The cloud clean-up that only starts when the monthly bill makes the finance director pick up the phone.
The fix is boring, which I suspect is why it’s rare. Ghost hunting has to be a routine with a date on it.
If ghost hunting isn’t in the calendar, it happens after the breach.
The action: Book a 90-minute ghost hunt every quarter and rotate the focus: accounts first, then infrastructure, then rituals, then skills. Yes, I’m asking you to create a recurring meeting. Give it an end date.
The question is?
Nothing about the VPN account that shut down Colonial Pipeline was clever. Someone set it up, someone stopped using it, and no one switched it off. That’s the whole story.
Dead things are dangerous for one reason: they still hold the keys. An account still logs in. A server still listens on a port. A meeting still eats your Tuesday. A skill still shapes how you see the problem in front of you.
The ghosts in the film are mostly just stuck. They walk the same corridors because no one has told them they can stop.
So here’s my question, and it’s for you more than for your organisation.
What in your working week is still logged in after it died? And how sure are you that it isn’t you?
If you run a ghost hunt this quarter, tell me the oldest thing you found. The best story gets its own post on blog.ogunlana.net.