Frictionless infrastructure access still depends on stronger identity controls

At a glance

What this is: This recap argues that engineering teams can reduce access friction without weakening security by replacing static credentials, standing privileges, and VPN-centric access with identity-based, just-in-time controls.

Why it matters: It matters because IAM, PAM, and NHI programmes all break down when users and workloads can only move quickly by bypassing governance with shared secrets, local keys, or always-on privilege.

👉 Read Teleport's recap of frictionless access without sacrificing security

Context

Infrastructure access has long been treated as a trade-off between security and speed, but that framing is too narrow. The real problem is that access models built around persistent privilege, static secrets, and manual approval loops do not fit modern engineering workflows, especially when teams need immediate access during incidents or release pressure. This is an IAM, PAM, and NHI governance problem at the same time.

Teleport’s recap focuses on identity-based access as the alternative to perimeter-style connectivity and workaround-driven operations. The operational question is not whether engineers should move quickly. It is whether the access model can remove the incentives to store keys locally, hardcode tokens, or leave privileged access always on while still preserving auditability and control.

Key questions

Q: How should security teams implement just-in-time access without leaving standing privilege behind?

A: Treat access as a live session, not a temporary account. Enforce real-time policy evaluation at request time, bind access to context such as device posture and business justification, and revoke it when the session or context changes. If the identity or role remains reusable after the task, the organisation has not achieved Zero Standing Privilege.

Q: Why do static credentials increase risk in engineering environments?

A: Static credentials persist beyond the work they were created for, which makes them easy to copy, hardcode, share, or forget during offboarding. That persistence creates a larger attack window and a slower revocation process, especially across distributed infrastructure and multi-cloud estates.

Q: What breaks when a VPN is used as the main remote access control in hybrid environments?

A: The main failure is that a VPN authenticates the user and then grants broad network reach, which makes lateral movement much easier than application-scoped access would. In hybrid environments, that means the control protects the entry point but not the post-login attack surface. Security teams should judge remote access by how little it exposes after login, not by whether the tunnel works.

Q: Who should be accountable for frictionless access without weakening security?

A: IAM, PAM, and infrastructure owners should share accountability for the access model, because speed and control are both governance outcomes. The test is whether access can be granted quickly, limited precisely, and revoked cleanly without creating local workarounds or permanent privilege.

Technical breakdown

Why static credentials create access debt

Static credentials such as API keys, SSH keys, and passwords create access debt because they remain valid beyond the task that required them. Once they exist, they are easy to reuse, copy, hardcode, or leave behind in source code and local environments. That expands the attack window and makes revocation slower than the operational need that created the access in the first place. In identity terms, the credential outlives the intent. That is why persistent secrets become a governance problem, not just a hygiene issue.

Practical implication: replace durable credentials with short-lived, task-scoped access where the business process can tolerate it.

How standing privilege undermines least privilege

Standing privilege means elevated access is always available even when the user is not actively performing the privileged task. That weakens least privilege because the permission exists continuously rather than being granted only when required. It also makes misuse harder to detect, since the access path is normalised and always open. In infrastructure environments, this creates a broad blast radius for accidental changes, insider misuse, and compromised accounts. The issue is not merely over-permissioning, but over-permissioning that persists without a clear end state.

Practical implication: move privileged access into a just-in-time model with expiry, approval, and session visibility.

Why VPN-centric access increases lateral movement risk

VPNs extend network reach instead of proving identity at the resource boundary. Once a VPN session is compromised, the attacker often inherits broad internal connectivity that can support discovery and lateral movement across exposed services. Identity-based access models narrow that exposure by binding each session to a cryptographic identity and a specific resource path. That changes the control point from the network perimeter to the access decision itself. For multi-cloud and hybrid estates, this distinction matters because connectivity is not the same thing as authorised access.

Practical implication: reduce reliance on perimeter connectivity for privileged administration and enforce resource-level identity checks instead.

Threat narrative

Attacker objective: The attacker objective is to turn convenient access shortcuts into durable control over infrastructure and adjacent systems.

1. Entry occurs when an engineer or attacker obtains a static credential, a locally stored key, or persistent privileged access that was meant to speed up operations.
2. Escalation follows when that standing access is reused beyond its intended task, enabling broader system reach, configuration changes, or lateral movement through internal infrastructure.
3. Impact appears as credential leakage, unauthorized access, or operational compromise, with the blast radius amplified by always-on access paths and fragmented governance.

Breaches seen in the wild

• New York Times breach — New York Times source code and credentials exposed via GitHub.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static credentials are access debt, not convenience. The article describes a familiar engineering pattern: teams save time by reusing keys, tokens, and passwords, then inherit the security burden later. That is not a tooling issue alone. It is a lifecycle failure in which credential creation is easier than credential retirement, so the identity system accumulates dormant risk. Practitioners should treat persistent secrets as liabilities that must be retired as aggressively as they are issued.

Standing privilege is the control failure most teams normalise. Always-on admin access is often justified as operational efficiency, but it erases the boundary between routine access and elevated authority. That makes detection, certification, and review less meaningful because privilege is present before the need exists. The practical conclusion is that PAM cannot be bolted onto a workflow that assumes permanent elevation.

Unified access is now an identity governance requirement, not a platform preference. The article’s multi-cloud and hybrid framing shows why fragmented controls produce inconsistent decisions across environments. When access is split across VPNs, bastions, secrets managers, and ad hoc policies, governance becomes a reconciliation exercise instead of a control model. That complexity is exactly where NHI drift and engineer workarounds thrive.

Identity blast radius is the right concept for modern infrastructure access. The key question is not whether access is fast, but how far a single credential or session can travel when something goes wrong. In environments with identity-based proxying, short-lived certificates, and session recording, the blast radius shrinks because access is narrower and more observable. Practitioners should measure access by containment, not just by convenience.

From our research:

• Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
• Another finding from the same report shows that 35.6% of organisations cite consistent access across hybrid and multi-cloud environments as their top NHI security challenge.
• For the lifecycle side of this problem, see Ultimate Guide to NHIs , Static vs Dynamic Secrets for the governance model behind short-lived access.

What this signals

Static-credential friction is now a governance signal, not an engineering inconvenience. If engineers still create local copies of keys or tokens to keep delivery moving, the programme has already lost control of access lifecycle. That is why secret sprawl and permanent privilege should be measured as symptoms of a design mismatch, not as isolated policy violations.

Identity teams should expect more pressure to prove that access can be both fast and revocable. The strongest programmes will align PAM, NHI lifecycle governance, and infrastructure access design so that approvals, expiry, and auditability are built into the workflow rather than layered on after the fact. For the control model, the most relevant external baseline is NIST SP 800-53 Rev 5 Security and Privacy Controls.

The operational benchmark is shrinking blast radius without reintroducing manual bottlenecks. That means identity-bound sessions, short-lived credentials, and clear owner responsibility for every privileged path. For teams formalising that direction, OWASP Non-Human Identity Top 10 remains a useful lens for the same control failures in machine access.

For practitioners

• Retire static secrets from production access paths Remove long-lived API keys, SSH keys, and passwords from the normal path for infrastructure administration. Replace them with short-lived credentials where task and environment allow it, and block new secret creation in source code and build files.
• Convert standing admin access into just-in-time privilege Require a request, approval, and expiry for elevated access so privileged sessions end when the task ends. Tie the approval flow to the specific resource and session, not to a blanket role that stays active indefinitely.
• Reduce VPN reliance for privileged operations Limit VPN usage as a default administration path and move privileged workflows to identity-bound access controls that evaluate the session at the resource boundary. This narrows lateral movement opportunities if a session is compromised.
• Instrument session recording and audit trail review Record privileged sessions and verify that logs capture who accessed which system, when access expired, and whether the activity matched the approved task. Use those records to support recertification and incident forensics.

Key takeaways

• Frictionless infrastructure access fails when teams rely on static credentials and standing privilege to compensate for weak workflow design.
• The core risk is not just slower approvals, but broader blast radius, weaker auditability, and more incentives for unsafe workarounds.
• The control shift is toward identity-based, just-in-time access that preserves engineering speed while shrinking persistent exposure.

Key terms

• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Static Credential: A static credential is a long-lived secret such as an API key, password, token, or certificate that exists outside the moment of use. It creates persistent attack surface because it can be copied, stored, reused, and exposed across code, pipelines, configuration files, and third-party environments.
• JIT — Just-in-Time Access: A security approach that grants access permissions only for the duration needed to complete a specific task, then automatically revokes them. JIT access eliminates standing privileges for NHIs, dramatically reducing attack surface.
• Identity-Based Authorization: Identity-based authorization grants access based on verified identity attributes instead of network location. For remote devices, that means labels such as customer, region, or lifecycle state can control access even when the underlying transport changes.

What's in the full article

Teleport's full blog recap covers the operational detail this post intentionally leaves for the source:

• A closer look at the webinar discussion on approval delays during incident response and production debugging
• Teleport's step-by-step explanation of certificate-based access, proxy-based connectivity, and session recording
• The article's practical walkthrough of replacing VPN-centric access with identity-based tunnels and private resource access
• Examples of how the vendor frames frictionless access for engineers working across multi-cloud and on-prem infrastructure

👉 Teleport's full recap includes the webinar discussion, access-model examples, and the operational steps behind the access approach.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.