Hybrid security trends show PAM remains the weakest control gap

At a glance

What this is: This report from Netwrix says hybrid security still leaves privileged access management as the weakest control gap, with cyberattacks and PAM improvement priorities both showing up strongly in the survey results.

Why it matters: It matters because identity programmes in hybrid estates often fail at privilege governance before they fail at perimeter coverage, which makes PAM a core control for both human and non-human access paths.

By the numbers:

• 68% of organizations suffered a cyberattack within the last 12 months.
• 49% of respondents would opt to improve privileged access management in their organization if they could decide on their own.
• 81% of organizations worldwide now use at least one cloud environment.
• Netwrix Research Lab surveyed 1,610 IT professionals from 106 countries.

Context

Privileged access management, or PAM, is the control plane for elevated access across hybrid environments. In this report, the core problem is not cloud adoption itself but the uneven control of privileged identities as organisations move between on-premises systems and cloud services.

Netwrix’s survey results show that hybrid security programmes can have broad coverage and still leave the highest-risk accounts insufficiently governed. For IAM teams, that means the question is less about whether access exists in cloud or on premises and more about whether elevated access is accountable wherever it is used.

Key questions

Q: Why do privileged access controls break down in hybrid environments?

A: Hybrid environments fragment identity evidence across clouds, endpoints, workflows, and ticketing systems. When privilege is distributed across those layers, no single control plane shows the whole story. Teams then spend more time proving access history than governing it, which is exactly where audits become slow and incomplete.

Q: Why does cloud adoption change how organisations should manage privileged access?

A: Cloud environments change both the control surface and the tools used to reach it. Access is often delivered through web consoles and APIs instead of traditional on-premise interfaces, which expands the number of privileged entry points that must be monitored. That shift also means privileged access is no longer confined to IT administrators. More users and more service paths require stronger governance.

Q: How should security teams compare PAM solutions for hybrid environments?

A: Start with the controls that reduce exposure, not the feature count. Prioritize platforms that enforce JIT access, rotate credentials automatically, centralize secrets, and preserve auditability across on-prem, cloud, and remote administration paths. If a tool cannot prove those outcomes in your environment, it is unlikely to reduce privileged risk meaningfully.

Q: What happens if cloud and on-premises privilege rules are not aligned?

A: Teams end up with two governance standards for the same risk, which creates weak points wherever the lighter policy applies. That inconsistency encourages overprivileged access, fragmented reviews, and slower containment during an incident. The result is not just a compliance issue. It is a wider operational exposure because attackers will follow the least governed administrative path.

Technical breakdown

Why PAM becomes the weak point in hybrid identity

Hybrid environments create multiple administrative planes, each with different privilege models, logging paths, and recovery assumptions. PAM sits across those planes because it governs who can use elevated access, how that access is approved, and whether privileged sessions are constrained. When organisations extend identity controls into cloud services without aligning admin roles, standing privilege, and session oversight, the control gap appears at the exact point where attackers benefit most: elevated access.

Practical implication: Treat PAM as a cross-environment control boundary, not a separate on-premises toolset.

What cyberattack frequency says about privilege exposure

A high attack rate does not prove PAM failure on its own, but it does show that elevated access remains a high-value target in real operating conditions. In hybrid estates, privileged credentials often connect identity systems, infrastructure platforms, and administrative workflows, so compromise of one privileged path can affect several environments. That makes privilege governance a blast-radius problem as much as an access-control problem.

Practical implication: Map privileged account exposure to the environments and systems each account can reach, not just to the account owner.

Why cloud adoption does not eliminate classic privilege risks

Moving workloads into cloud environments changes administration, but it does not remove privileged access patterns such as shared admin roles, lingering entitlements, or excessive access scope. Cloud adoption can make privilege easier to distribute and harder to see if governance, recertification, and monitoring remain fragmented. The result is a control environment where access is technically modern but operationally familiar: too much standing privilege, too little oversight.

Practical implication: Review cloud and on-premises privileged roles together so the same governance rules apply across both.

NHI Mgmt Group analysis

Hybrid security usually fails first at privilege, not perimeter. The report’s numbers point to a programme reality that many teams already know but understate in planning: broad security coverage does not matter if elevated access is still loosely governed. PAM becomes the control that decides whether identity boundaries hold under pressure, especially where cloud and on-premises administration overlap. For practitioners, that means the risk discussion should start with privileged access paths rather than with environment type.

Standing privilege is the hidden debt inside hybrid estates. Once organisations allow the same administrative logic to persist across cloud and legacy systems, they accumulate access paths that are difficult to recertify, monitor, and retire cleanly. That debt is not visible as a single control failure, but it shows up in incident response, audit friction, and slow containment when privilege is abused. The practitioner lesson is to treat excess privilege as a lifecycle problem, not a one-time configuration issue.

PAM is now a governance signal for the maturity of the whole identity programme. If a hybrid organisation cannot describe who can elevate, when, and under what conditions, it has not finished the move from access administration to access governance. This is as true for human administrators as it is for service accounts that back administrative workflows. Stronger identity programmes will be measured by how tightly they constrain privilege across both domains.

Cloud adoption has exposed a privilege blast-radius gap. The report shows that organisations can expand cloud usage while still failing to limit what privileged identities can touch. That creates a larger failure domain when credentials, roles, or admin tokens are compromised. The consequence for security architects is straightforward: privilege design now has to be evaluated by reachable impact, not by where the workload happens to run.

Privileged access management is the control that converts identity policy into operational restraint. Without it, identity policy remains an inventory of entitlements rather than a mechanism for limiting what an administrator can do in practice. That distinction matters most in hybrid environments, where identity sprawl and platform diversity make overscoped access the default unless it is actively governed. The field should treat PAM as a core identity security discipline, not an optional add-on.

What this signals

Hybrid identity programmes should be judged by how tightly they constrain elevation, not by how widely they extend connectivity. When privileged access is easier to obtain than to justify, the programme is already carrying hidden risk across every environment it governs.

PAM control debt: Hybrid estates accumulate risk when standing administrative access is allowed to persist across cloud and legacy systems. That debt shows up as larger blast radius, weaker accountability, and more difficult incident containment.

For practitioners, the practical shift is to govern privilege as a lifecycle discipline across both human administrators and machine-backed administrative paths. That means unifying approval, monitoring, and review expectations before the next incident forces the issue.

For practitioners

• Tighten privileged role inventory Catalogue every privileged account, admin role, break-glass path, and delegated elevation route across on-premises and cloud platforms. Separate human administrative access from service and workload identities so the governance model reflects how each is actually used.
• Review standing privilege by environment Identify where privileged access persists beyond the task, session, or approval that justified it. Prioritise accounts that can reach multiple systems, because hybrid blast radius grows when a single privilege path spans several environments.
• Align PAM controls across cloud and on-premises Apply the same approval, session oversight, and recertification expectations to both cloud administrative roles and legacy infrastructure accounts. Disparate control standards create blind spots that attackers can exploit through whichever environment is least governed.
• Use cyberattack data to prioritise remediation Focus first on privileged pathways that combine high exposure with broad reach, especially where audit evidence is weak or role ownership is unclear. In hybrid programmes, the accounts that matter most are rarely the most numerous, but they are the easiest to abuse.

Key takeaways

• The report shows that hybrid security still has a privilege problem, even where cloud adoption is already mainstream.
• The survey figures point to a large attack surface and a strong practitioner appetite for better PAM controls.
• Security teams should treat privileged access governance as a core hybrid control, not a separate legacy concern.

Key terms

• Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Hybrid Identity Management: Hybrid Identity Management is the coordinated control of identities across on-premises and cloud environments. It links directories, authentication, authorization, and lifecycle processes so people, applications, and machines can access resources consistently. Technically, it spans federation, synchronization, policy enforcement, and governance across multiple identity domains.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.