ARCON’s PAM portfolio highlights the gap in NHI governance

At a glance

What this is: This is a portfolio overview that argues privileged access, endpoint privilege management, cloud governance and vaulting belong in one control model because the NHI governance problem spans all of them.

Why it matters: It matters because IAM and PAM teams cannot treat service accounts, elevated endpoints and cloud entitlements as separate problems if they want consistent lifecycle control over non-human identities.

👉 Read Arcon’s PAM portfolio overview on privileged access, cloud governance and NHI gaps

Context

Non-human identity governance is the control gap that appears when service accounts, vaults, endpoint elevation and cloud entitlements are managed as separate operational silos. In practice, that fragmentation leaves no single lifecycle view of who or what can act, for how long, and under which approvals.

Arcon’s product pages frame these capabilities as one stack, but the governance question is broader than product packaging. The practical issue for IAM and PAM teams is whether privilege, secrets and configuration drift are being governed with the same discipline across machine identities that is expected for human access.

Key questions

Q: What breaks when PAM only covers human administrators?

A: A human-only PAM model leaves service accounts, workloads, and AI-connected systems outside the same governance discipline. Those identities can still perform privileged actions, but they often bypass human approval, lifecycle review, and session oversight. That creates hidden privilege paths that are harder to audit and revoke.

Q: Why do unnecessary cloud rights keep reappearing even after cleanup?

A: Because cloud permissions often drift through inherited roles, temporary exceptions and deployment shortcuts that never get reconciled against the approved state. If the organisation only cleans up at provisioning time, effective access will keep diverging from policy. Continuous entitlement review is what closes the gap.

Q: How should teams reduce endpoint privilege without creating new blind spots?

A: By linking endpoint elevation to the rest of the identity lifecycle so local admin rights are not the only thing being controlled. A user or automation flow can still hold broad cloud or vault access even when workstation privilege is constrained, so the control model has to span the full path of privilege.

Q: What is the difference between vaulting secrets and governing them?

A: Vaulting is storage control. Governing secrets means knowing where they move, who owns them, when they expire, and whether they are still justified. A secret can be safely stored and still be operationally unsafe if it is copied into chat tools, duplicated in files, or left active after offboarding.

Technical breakdown

Why privileged access and NHI governance converge

Privileged access management is not only about admins. In modern environments, service accounts, automation tokens, vault-stored secrets and cloud entitlements often carry the same blast radius as human administrator roles. When those identities are granted access, the security problem becomes lifecycle control: ownership, scope, rotation, offboarding and review. A PAM programme that stops at human admins leaves the highest-risk non-human paths outside the governance model. The useful unit of control is the privileged identity, not the employment status of the actor behind it.

Practical implication: Map every high-impact non-human credential to the same ownership, review and revocation process used for human privileged access.

How endpoint privilege management changes the control boundary

Endpoint privilege management narrows standing rights by granting local elevation only when a task requires it. For identity teams, that shifts control from static workstation roles to just-in-time privilege issuance and monitoring. The security value is strongest when endpoint elevation is treated as part of the same entitlement model as server, cloud and vault access, because users and automated workflows often cross those boundaries in the same business process. Without that linkage, local privilege reduction can coexist with persistent upstream access that still enables misuse.

Practical implication: Treat endpoint elevation, cloud entitlements and privileged session controls as one policy domain instead of separate remediation projects.

Why cloud governance and drift management matter for machine access

Cloud governance and drift management address the fact that access and configuration change continuously after provisioning. For NHIs, that matters because privileges often expand quietly through policy drift, inherited roles and temporary exceptions that become permanent. Drift management does not replace access governance, but it exposes where the approved state and the effective state diverge. That divergence is where machine identities accumulate risk, especially when access is granted for deployment, automation or service continuity and never revisited.

Practical implication: Continuously compare approved NHI entitlements with actual cloud permissions and revoke access that no longer matches the intended state.

Threat narrative

Attacker objective: Gain durable high-impact access through overprivileged non-human or elevated identities and use it to reach sensitive systems or data.

1. Initial access occurs when a privileged or service identity has more access than its owner expects, allowing use of standing credentials or inherited rights.
2. Privilege escalation follows when broad vault, cloud or endpoint permissions let that identity reach sensitive resources beyond its original task scope.
3. Impact emerges as the same over-permissioned identity can modify configurations, access sensitive data or persist through weak offboarding and drift controls.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privileged access is now an NHI governance problem, not just a PAM problem. The article’s core message is that access control has to follow the identity, whether that identity is a person, a workstation principal or a service account. That matters because non-human privileges create the same blast radius as human admin rights, but they are often managed outside the lifecycle processes used for human access. The implication is that PAM and NHI governance have become the same operating discipline.

Cloud governance reveals the weakest part of many identity programmes: effective access drifts away from approved access. The control failure is not only excessive rights at provisioning time. It is the accumulation of unnecessary rights through exceptions, inherited permissions and configuration drift that never gets reconciled back to an owned state. Practitioners should treat this as an entitlement drift problem across cloud and machine identities, not a cloud-only hygiene issue.

Endpoint privilege management is most valuable when it is linked to the rest of the identity lifecycle. Just-in-time endpoint elevation reduces standing local privilege, but that benefit is limited if the same user or automation path still retains broad access elsewhere. The better model is a single entitlement view that spans endpoint, cloud, vault and service-account permissions. That is the governance pattern organisations need if they want to reduce privilege without creating blind spots.

Vaulting alone does not solve service-account risk if lifecycle ownership is unclear. A central store can reduce password handling, but it can also hide the fact that no one is actively governing who can use the credential, when it expires and when it should be retired. That makes the named concept here credential custody without lifecycle control. Teams should focus on who owns the credential, not only where it is stored.

Identity programmes need a unified privileged-access inventory across human and non-human actors. The portfolio framing is a reminder that access management, governance and identity security are converging into a shared control surface. Where organisations still split human IAM, PAM and NHI operations, they miss the cross-over cases where a service account, a vault secret and a cloud role together create the breach path. Practitioners should consolidate inventory, review and revocation logic across those paths.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Privileged Access Management Guide

What this signals

Credential custody without lifecycle control: Centralised vaulting is useful, but it does not remove the need to know who owns each secret, when it expires and when it should be retired. When that discipline is missing, the organisation may have storage without governance, which is exactly how non-human identity risk persists across service accounts and automation paths.

The practical signal for IAM teams is that PAM, cloud governance and endpoint privilege cannot stay in separate operating lanes. If the effective permissions of a service account, a cloud role and a local admin path are not reviewed together, privilege creep will keep rebuilding the same attack surface.

A useful benchmark is that 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs. That figure underlines why entitlement review has to move from a periodic cleanup exercise to a continuous governance function.

For practitioners

• Unify privileged access inventories Create one inventory of human and non-human privileged identities so service accounts, vault secrets, cloud roles and endpoint elevation can be reviewed together.
• Tie cloud drift to access review Compare approved cloud entitlements with effective permissions on a recurring basis and remove rights that no longer match the intended operating state.
• Extend just-in-time controls beyond endpoints Apply just-in-time elevation rules to the identities that actually hold the risk, including service accounts and administrative workflows, not only interactive users.
• Govern vault ownership and expiry Assign named owners to critical credentials, define expiry expectations, and retire secrets when the underlying service or access path is no longer needed.

Key takeaways

• The article frames privileged access, endpoint elevation and cloud governance as one identity governance problem rather than three isolated tool categories.
• The main risk is unmanaged privilege across service accounts and other non-human identities, where ownership and lifecycle controls are often weaker than for human access.
• Organisations need a single review and revocation model for privileged identities, or drift and overpermissioning will keep reappearing.

Key terms

• Privileged non-human identity: A privileged non-human identity is any service account, API key, token, certificate, workload, or AI agent that can reach sensitive systems and perform high-impact actions. The risk comes from the access it carries, not from whether a person is operating it directly. Governance must cover lifecycle, scope, and attribution.
• Privilege Drift: Privilege drift is the gradual gap between the permissions an identity was meant to have and the permissions it actually retains. In AI agent environments, drift grows quickly because roles are reused, tasks change, and lifecycle reviews often lag behind deployment velocity.
• Vaulted Credential Workflow: A process where credentials remain stored in an approved vault and are only released through a controlled action. This approach supports auditability, policy enforcement, and separation of storage from use. It is especially useful when operators need speed without exposing passwords in notes, files, or chat tools.
• Just-in-time privilege: A privilege model that grants elevated access only when a specific task requires it and removes it as soon as the task ends. It reduces exposure time, limits lateral movement opportunities, and is especially useful for high-risk human and machine identities.

What's in the full article

Arcon’s full article covers the product-side detail this post intentionally leaves at the governance level:

• Specific product components for privileged access management, endpoint privilege management and cloud governance
• Descriptions of how the vendor positions vaulting, MFA and drift management within one portfolio
• High-level use-case framing for enterprises looking at access control, compliance and identity security
• The broader portfolio list and navigation context that shows how the product set is packaged

👉 The full Arcon page shows how its PAM, EPM, vaulting and cloud governance components are presented together.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.