TL;DR: Teleport says static credentials, standing privileges, and fragmented access paths still push engineers toward insecure workarounds even when teams try to reduce access friction in infrastructure environments. The control problem is not speed alone but whether identity governance can remove persistent secrets and preserve auditability.
At a glance
What this is: Teleport’s recap argues that frictionless infrastructure access still depends on replacing static credentials, standing privileges, and VPN-based access with identity-bound, just-in-time controls.
Why it matters: This matters because IAM, PAM, and NHI programmes have to reduce access friction without reintroducing persistent secrets, invisible privileges, or weak auditability across engineering workflows.
By the numbers:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
👉 Read Teleport's analysis of frictionless infrastructure access and identity controls
Context
Infrastructure access becomes a governance problem when teams cannot move quickly without creating persistent secrets or broad standing access. In this article, the primary issue is the tension between engineering speed and identity controls, especially where access approvals, VPNs, and manual permissions create incentives to bypass policy.
That tension maps directly to NHI and human IAM programmes because the same access patterns affect API keys, SSH keys, passwords, and privileged roles. When access has to be fast but still accountable, the real question is whether the identity model can support ephemeral access without weakening auditability or control.
Key questions
Q: What breaks when organisations rely on static credentials instead of temporary elevated access?
A: Static credentials tend to outlive the task, the user, and sometimes the control that issued them. That creates unused privileges, harder revocation, and a larger attack surface if secrets leak. In cloud environments, the failure is usually operational as much as security related: access becomes difficult to audit, rotate, and contain with confidence.
Q: Why do standing privileges increase risk in engineering environments?
A: Standing privileges keep administrative access available all the time, which enlarges blast radius and weakens accountability. If an account is compromised or a misconfiguration occurs, the access already exists, so the damage is limited less by policy than by how broad the standing role was.
Q: How can security teams reduce friction without weakening privileged access controls?
A: Reduce friction by centralizing policy, shortening approval paths for low-risk tasks, and automating credential expiry and revocation. The goal is to make compliant access faster than workaround behavior. If legitimate access is slow, users and engineers will create shadow processes that are harder to govern than the original control.
Q: How do IAM teams know whether access governance is working?
A: IAM teams should look for fast revocation after role change or departure, accurate entitlement data, and low numbers of orphaned or over-provisioned accounts. If access creation is easy but removal is slow, governance is incomplete. The strongest signal is whether access still matches business need after the identity changes.
Technical breakdown
Why static credentials become the fallback control
Static credentials such as API keys, SSH keys, and passwords create a durable access path that is easy to reuse but hard to govern. Once they are saved locally, hardcoded into build files, or shared to avoid access delays, they outlive the approval process that was supposed to protect them. That changes the security model from controlled issuance to hidden reuse. In NHI terms, the credential becomes the control surface, which means compromise, leakage, and drift are no longer edge cases but expected operating conditions when access friction stays high.
Practical implication: treat every persistent secret as a governance exception and measure how often engineers bypass formal access paths.
How standing privilege breaks least-privilege access
Standing privilege means elevated access remains continuously available rather than being issued only for a specific task. That is efficient for users, but it expands blast radius because administrative rights exist before the work starts and after it ends. In infrastructure environments, that persistence also weakens accountability because the access state no longer matches the task state. For IAM and PAM teams, the technical problem is not just privilege level but privilege duration, since always-on access is what enables abuse, accidental misconfiguration, and lateral movement once an account is exposed.
Practical implication: use task-scoped elevation for administrative paths instead of leaving privileged access permanently enabled.
Why VPN-centric access models weaken identity governance
VPNs extend network reach rather than prove task-specific identity intent, which is why they often preserve broad access once a session is established. In the article’s framing, that perimeter logic clashes with zero trust architecture because the network tunnel becomes the implicit trust boundary. Identity-based proxies and cryptographic certificates change the model by binding access to a session, a resource, and an authenticated identity rather than to an open network path. That is the real shift from network access to governed access, and it is why VPN retirement affects both control design and auditability.
Practical implication: map each VPN dependency to a resource-specific identity path before you consider the access model acceptable.
Threat narrative
Attacker objective: The attacker or insider wants durable access to infrastructure that is difficult to distinguish from legitimate engineering activity.
- Entry begins when teams store API keys, SSH keys, or passwords locally or in build files to avoid access delays.
- Privilege escalation follows when those same credentials grant always-on administrative reach instead of task-scoped access.
- Impact occurs through unauthorized access, accidental misconfiguration, or lateral movement enabled by broad, persistent access paths.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Stryker Microsoft Intune Wiper Attack: Compromised Microsoft Intune credentials enable wiper attack wiping 200,000 Stryker devices.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Standing privilege is the governance assumption that access can exist before the task begins. That assumption breaks when infrastructure work is urgent, distributed, and multi-cloud, because access becomes a permanent state instead of a temporary need. The result is not just excess privilege but a programme that certifies the wrong thing. Practitioner conclusion: identity governance has to measure privilege duration, not only privilege level.
Static credential reliance creates an identity shadow layer outside formal access controls. Engineers reach for locally stored secrets and hardcoded tokens when approvals are slow or fragmented, which means the control plane is no longer the only place where access lives. That is a governance failure because lifecycle, audit, and revocation all lose visibility once credentials escape central management. Practitioner conclusion: persistent secrets should be treated as evidence of process failure, not user convenience.
Frictionless access and strong control are no longer opposing goals when session identity replaces network trust. Identity-based access models can preserve speed only if they bind access to a short-lived, auditable session rather than a reusable credential or open tunnel. That shifts security design toward issuance-time control and away from perimeter assumptions. Practitioner conclusion: the architecture must make the secure path faster than the workaround.
Zero standing privilege is the more accurate control target for infrastructure operations. In this access model, privilege exists only long enough to complete the task and then disappears. That approach aligns the control state with the work state, which is exactly what standing access and static secrets fail to do. Practitioner conclusion: IAM, PAM, and NHI programmes should design for ephemeral authorisation as the default operating model.
Identity blast radius is the concept this article sharpens for modern infrastructure teams. The smaller the trust domain, the less damage a leaked secret, misused admin role, or compromised session can cause. This is not abstract theory but a practical way to think about access architecture across cloud, Kubernetes, and on-prem environments. Practitioner conclusion: reduce the number of identities and paths that can move from authentication to broad infrastructure reach.
From our research library:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
- Read next: Ultimate Guide to NHIs — Static vs Dynamic Secrets
What this signals
Identity blast radius: the real control question is how far a single credential or privileged session can move before it expires or is revoked. When teams keep static credentials in circulation, the access problem becomes larger than the user account that owns it, and the governance model has to shrink the reachable surface rather than just harden the login.
Access reviews are a weak answer when the underlying access state never goes away. Infrastructure teams need issuance-time controls, short-lived credentials, and resource-scoped policy because the review cycle cannot keep pace with work that depends on fast, repeated, and temporary access.
For practitioners
- Replace static credentials with short-lived access paths Eliminate locally stored API keys, SSH keys, and passwords for infrastructure work and issue access only for the task in progress.
- Convert standing privilege into task-scoped elevation Limit administrative reach to the specific resource and time window needed for the job, then revoke it automatically after use.
- Retire VPN dependence for resource access Move from perimeter tunnels to identity-based access that binds each session to authenticated identity and private resources.
- Track credential sprawl in build and ops workflows Review code, deployment files, and local workstations for secrets that are saved to bypass approval delays or repeated logins.
- Preserve session evidence for privileged work Require session recording and audit logs for elevated infrastructure access so reviewers can reconstruct who accessed what and why.
Key takeaways
- Static credentials and standing privileges create the very friction they are supposed to remove, because teams respond to delays by bypassing formal access paths.
- The article points to a control gap rather than a tooling gap: access has to become temporary, auditable, and tightly scoped to the task at hand.
- Infrastructure programmes improve when session identity, auto-expiry, and strong audit trails replace persistent secrets and always-on administrative access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Static credentials and hardcoded tokens are the article's core risk pattern. |
| NHI-05 — Overprivileged NHI | Standing admin access is the article's clearest privilege problem. | |
| NHI-07 — Long-Lived Secrets | The post centres on credentials that remain valid longer than the work they support. | |
| Recommendation — Scan for exposed secrets and remove persistent credentials from engineering workflows. Reduce always-on elevation and scope infrastructure access to the task being performed. Replace long-lived access with short-lived credentials that expire after use. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who can access infrastructure and for how long. |
| Recommendation — Apply PR.AA-05 to enforce task-scoped permissions and entitlement expiry. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential lifecycle management is central to replacing static secrets with controlled access. |
| AC-6 — Least Privilege | Standing privilege directly conflicts with least-privilege access design. | |
| Recommendation — Use IA-5 to govern authenticator lifecycle, rotation, and revocation. Apply AC-6 to limit administrative rights to the minimum necessary scope and duration. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Compromised static credentials and broad access paths map to credential abuse and movement risk. |
| Recommendation — Map exposed credentials to TA0006 and broad infrastructure reach to TA0008 in detections. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture — Zero Trust Architecture | The article explicitly contrasts VPN perimeter trust with identity-based access. |
| Recommendation — Replace perimeter trust with identity-centric access decisions and private session paths. | ||
Key terms
- Static Credential: A static credential is a long-lived secret such as an API key, password, token, or certificate that exists outside the moment of use. It creates persistent attack surface because it can be copied, stored, reused, and exposed across code, pipelines, configuration files, and third-party environments.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
- Identity-Based Authorization: Identity-based authorization grants access based on verified identity attributes instead of network location. For remote devices, that means labels such as customer, region, or lifecycle state can control access even when the underlying transport changes.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- Webinar discussion on why approval delays drive engineers toward insecure workarounds
- Practical examples of replacing passwords, API keys, and SSH keys with identity-bound access
- Session-level controls for granular role assignment and automatic expiry
- The access model used to replace VPN dependence with private, identity-based routing
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org