Continuous authorization and zero standing privilege for APT29 risk

At a glance

What this is: This StrongDM article says APT29’s abuse of legitimate accounts and OAuth traversal exposes the limits of legacy PAM and point-in-time access checks.

Why it matters: It matters because IAM teams need controls that keep evaluating access after login, especially for NHI, delegated, and human accounts that can be hijacked and reused inside trusted sessions.

Context

The core problem is access that remains valid after the initial check. In environments where trusted accounts, OAuth applications, and recycled credentials are allowed to persist, an attacker can move laterally and escalate without triggering the control model that many teams still rely on.

For identity and access programmes, this is not only an NHI issue or a human account issue. The article frames a broader authorization gap: static permission grants do not match modern cloud environments where account trust, session trust, and device trust all need to be re-evaluated continuously.

Key questions

Q: What breaks when legacy PAM is used against hijacked legitimate accounts?

A: Legacy PAM often assumes the important security decision happens at session start. When attackers compromise legitimate accounts, that assumption breaks because the session can remain trusted while the attacker changes behaviour inside it. Continuous re-evaluation is needed when the account itself no longer tells you whether the activity is benign.

Q: Why do standing credentials increase the risk of lateral movement in cloud environments?

A: Standing credentials remain usable long after the original business need has changed, so an attacker who inherits them can move across systems without re-authenticating. In cloud environments, where one identity can touch many tools, that persistence turns a single compromise into a broad access path. Short-lived authority limits that effect.

Q: How do security teams know whether continuous authorisation is actually working?

A: Teams know it is working when sensitive actions are blocked or stepped up based on context, not just login state. Good signals include denials for unusual device or location combinations, policy decisions recorded for every high-risk action, and reduced trust in long-lived sessions. If every action still passes once the login succeeds, the control is not active enough.

Q: What is the difference between zero standing privilege and just-in-time access?

A: Zero Standing Privilege is the access model that eliminates persistent privilege by default. Just-in-Time access is the operational mechanism that grants permission only when needed and removes it afterward. In practice, ZSP is the policy goal, while JIT is one way to implement it. Teams need both policy and automation to make the model work.

Technical breakdown

Why legacy PAM misses hijacked sessions

Legacy privileged access management often checks a user at the gate and then assumes the session remains valid. That model fails when attackers compromise legitimate accounts, because the account itself looks normal while the behaviour changes inside the session. In the article’s example, Cozy Bear used hijacked accounts, OAuth proxies, and recycled credentials to stay inside the trust boundary. The weakness is not only that access was granted, but that the environment treated approval at login as sufficient for the remainder of the session.

Practical implication: move from session-start approval to continuous authorization for high-risk access paths.

How standing credentials expand lateral movement risk

Standing credentials create an authorization window that outlives the task being performed. Once a credential or token remains usable after its intended purpose, an attacker who obtains it can reuse it for lateral movement, privilege escalation, and collection. The article links this to cloud environments where access is decentralized and difficult to track manually. That makes recycled credentials especially dangerous, because the environment cannot distinguish between legitimate reuse and hostile reuse once the standing privilege is in place.

Practical implication: reduce the number and lifespan of reusable credentials that can be replayed across sessions and resources.

What continuous authorization changes in practice

Continuous authorization means access is re-evaluated during the session, not just at the start. Signals such as device posture, session length, geography, role, and resource sensitivity can all influence whether the session continues. That matters because the attacker’s behaviour can diverge from the original approval context after the first authentication step. In this model, zero standing privilege and just-in-time access are enforcement patterns, while continuous authorization is the runtime decision layer that keeps those patterns alive.

Practical implication: enforce contextual policy checks during active sessions so abnormal access can be cut off before misuse compounds.

Threat narrative

Attacker objective: The objective was to maintain covert, trusted access long enough to move laterally, escalate privileges, and collect sensitive information without triggering obvious alarms.

1. Entry occurred through hijacked legitimate accounts and OAuth traversal rather than overtly malicious credentials, allowing the attacker to blend into trusted access patterns.
2. Credential access and reuse followed as overprivileged accounts, tokens, and sessions were leveraged to maintain access and move through the environment.
3. Escalation and lateral movement expanded the attacker’s reach across cloud infrastructure, including privilege escalation and distributed OAuth proxies.
4. Impact was the collection of sensitive information and prolonged covert access that was difficult to detect under static authorization controls.

Breaches seen in the wild

• SolarWinds supply chain compromise: A backdoored Orion build reached 18,000 customers; attackers then forged SAML tokens and hijacked app service principals.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Continuous authorization is the correct control response when the attacker behaves like a trusted user. This article shows that the real failure mode is not simply credential theft, but trusted access that stays trusted after behaviour changes. Once an attacker is inside a legitimate session, static approval models lose their ability to separate ordinary use from hostile use. Practitioners should treat runtime authorization as the enforcement layer, not the exception.

Standing privilege is a governance assumption that no longer matches cloud reality. Standing access was designed for environments where a small number of administrators held durable rights and review cycles could keep up. That assumption fails when access is decentralized, accounts are shared across tools, and attackers can reuse the same tokens and sessions for lateral movement. The implication is that access governance must be anchored at issuance and revalidation, not just at assignment.

Zero standing privilege is now an identity blast-radius control, not just a least-privilege slogan. The article’s APT29 example shows why persistent access turns every compromised session into a potential pivot point. When credentials outlive the task, the blast radius extends beyond the original login event and into the entire trust boundary. Practitioners should judge access models by how much reusable privilege they leave behind after approval ends.

Zero standing privilege applies across human, machine, and delegated access paths. The article focuses on human-compromised access, but the control logic is the same wherever identity can be reused inside a session. That makes the governance question broader than PAM alone: can the programme revoke trust as fast as it grants it? Teams should align authorization design to session reality, not role permanence.

Continuous authorization converts access review from a periodic process into a live decision model. Access review frameworks assume there is something stable to review. Here, the important issue is whether the environment can detect when a trusted session stops being trustworthy before the attacker finishes the job. The practitioner takeaway is to move review signals into the runtime path and stop depending on after-the-fact certification alone.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
• Read next: Zero Trust Identity Guide

What this signals

Continuous authorization turns access into a runtime decision, which is why static PAM models lose authority once a session is established. For identity programmes, the issue is not simply stronger authentication at the front door. The issue is whether the control plane can keep judging trust after the user, token, or delegated session is already inside the environment.

Zero standing privilege is the more honest operational target for cloud-era access governance. Persistent access is what gives intrusions room to breathe, and it is what makes stolen or hijacked credentials reusable across tools and resources. Teams that still depend on fixed privilege assignments should expect the blast radius of a compromise to remain too large.

90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs. That figure matters here because the same trust assumptions that fail for hijacked human accounts also fail for service credentials, tokens, and delegated machine access when they are allowed to persist.

For practitioners

• Replace one-time session approval with continuous checks Evaluate access during the session using context such as device posture, geolocation, role, and resource sensitivity. If the trust signal changes, stop the session before lateral movement or privilege escalation can continue.
• Eliminate standing credentials from high-risk paths Inventory accounts, tokens, and OAuth grants that remain usable after task completion, then reduce or remove them from cloud and admin workflows that do not require persistence.
• Bind elevated access to just-in-time approval Require explicit request, approval, and automatic expiry for privileged actions so reused credentials cannot quietly expand scope across the environment.
• Treat OAuth traversal as an authorization problem Review OAuth-connected applications and delegated grants as part of access governance, not just application inventory, because they can become the path for lateral movement and privilege escalation.
• Instrument session-level evidence for incident triage Keep audit logs rich enough to reconstruct who accessed what, from where, and under which policy state so security teams can distinguish legitimate use from compromised use quickly.

Key takeaways

• The article’s core warning is that attackers can remain effective after initial access when authorization is only checked once and then left alone.
• The same compromise pattern can support lateral movement, privilege escalation, and sensitive data collection when credentials and sessions stay valid.
• Continuous authorization, just-in-time access, and zero standing privilege reduce the amount of reusable trust an attacker can exploit.

Key terms

• Continuous authorization: Continuous authorization is the practice of rechecking access as a session unfolds instead of trusting a single login decision. It matters for AI workflows because the request, context, retrieved data, and downstream action can all change between prompt and execution, making static approval too blunt.
• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Standing Credential: A standing credential is any secret that remains usable until it is manually rotated or revoked. In NHI governance, it creates durable access that can be stolen, replayed, or propagated from trusted tooling unless runtime boundaries and expiry are built in.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.