The State of Employee Lifecycle Orchestration at NA Mid-Market 2026.

Five findings for your morning briefing

1. 01

   Ghost-account rates stuck at 20-35% at mid-market

   Stitchflow and Nudge Security public telemetry confirms a 20-35% 90-day ghost-account rate at mid-market without automation. A 2,000-employee company averaging 10 terminations per month carries 24-42 live former-employee SaaS entries at any moment.

2. 02

   SOC 2 auditors shifted from per-system to per-subject sampling

   Per-system quarterly campaigns no longer clear CC6.2. Auditors now ask for the complete per-subject access history across all 40+ apps from hire through post-termination. This is why VP People joined the buying committee.

3. 03

   State privacy laws compound — one request triggers five regimes

   CCPA, NY SHIELD, Colorado AI Act, Texas TDPSA, and EU AI Act Article 26 each impose distinct audit-trail obligations on the same former-employee record. A single DSAR can trigger five parallel investigations.

4. 04

   Tri-buyer committee shift is measurable, not rhetorical

   Forrester 2025 Wave for SaaS Management: 62% of mid-market evaluations in 2026 include VP People + CIO + CISO, versus 23% in 2022. IT-only procurement paths now lose more deals than they win at 500-5,000 employees.

5. 05

   A structural tooling gap exists at 500-1,500 employees

   Stitchflow targets $5k+/mo IT-led deployments. SailPoint and Saviynt require 5,000+ employee dedicated identity programs. Zluri, BetterCloud, Torii are management suites where lifecycle is a module. The VP-People-led mid-market tier is served only by spreadsheets.