Infrastructure access security is lagging behind cloud complexity

At a glance

What this is: Teleport’s survey argues that infrastructure access security has become materially harder as cloud sprawl, identity attacks, and compliance pressure expand the number of credentials, secrets, and access paths to govern.

Why it matters: For IAM, PAM, and NHI teams, this matters because access controls that still assume stable infrastructure and isolated ownership are already out of step with how modern systems are operated.

By the numbers:

• 89% of organisations suffered at least one security incident in the past three years.
• 88% of survey respondents said the increase in credentials and secrets creates a significant challenge for infrastructure access security.
• 86% of respondents included sustaining DevOps pipelines as a chief concern when securing infrastructure access.

👉 Read Teleport’s 2024 survey on secure infrastructure access challenges and leader practices

Context

Infrastructure access security is the discipline of controlling who and what can reach cloud, edge, and on-prem systems without creating bottlenecks for engineering teams. The problem is no longer just authentication at the front door. It is the accumulation of credentials, secrets, and ad hoc access paths across fast-changing infrastructure, which turns access governance into a continuous operational issue.

Teleport’s survey frames that problem as a maturity gap between organisations that can centralise identity and those that still rely on scattered access paths and standing credentials. For IAM, PAM, and NHI programmes, the key question is whether access remains reviewable, revocable, and auditable once infrastructure changes faster than governance processes do.

The pattern is typical of modern infrastructure operations rather than an edge case. Cloud scale, remote administration, and DevOps velocity are now the baseline, so access governance must be designed for constant change instead of periodic cleanup.

Key questions

Q: How should security teams reduce standing privilege in cloud environments?

A: Start by identifying which cloud roles, service accounts, and automation identities have persistent access they do not need every minute of the day. Move high-risk actions to just-in-time elevation, shorten approval windows, and require automatic revocation after the task ends. That turns privileged access into a controlled event rather than a permanent entitlement.

Q: Why do credentials and secrets create so much risk in modern infrastructure?

A: Because each credential or secret is both an access path and a lifecycle obligation. As cloud services, pipelines, and integrations multiply, the number of places where credentials can be exposed, reused, or forgotten grows faster than manual review can keep up, which increases the likelihood of unauthorized access and compliance gaps.

Q: What breaks when infrastructure access controls are split across security, engineering, and compliance teams?

A: The organisation loses a single source of truth for who can access what, when access expires, and how evidence is produced. In that model, engineers optimise for speed, security optimises for control, and compliance optimises for proof, but no team can reliably show the full picture across the access lifecycle.

Q: How do organisations know whether their infrastructure access programme is actually working?

A: Look for fewer standing credentials, faster revocation, and fewer exceptions handled outside the normal workflow. A working programme produces consistent audit evidence, reduces access sprawl over time, and lets teams make changes without reintroducing unmanaged paths or slowing delivery.

Technical breakdown

Why credentials and secrets proliferate across modern infrastructure

Modern infrastructure multiplies identity artefacts because every cloud service, pipeline, environment, and integration tends to require its own credential or secret. That includes human admin access, service accounts, API keys, tokens, certificates, and ephemeral access paths used by engineering teams. The technical problem is not simply volume. It is fragmentation, because each silo creates its own lifecycle, monitoring, and revocation burden. When those credentials are hard-coded, shared, or reused across environments, the attack surface expands faster than governance can track it.

Practical implication: inventory credentials and secrets by system, owner, and lifecycle state before trying to tighten policy.

Standing privileges are the wrong default for elastic systems

Standing privilege assumes an access path should remain valid until someone remembers to remove it. That model breaks down in infrastructure where instances are short-lived, change is frequent, and access needs are task-specific. Ephemeral or cryptographic access reduces persistence, but only if the underlying trust model is also temporary and scoped. If long-lived credentials remain in the background, the organisation still carries dormant access even when the visible session looks controlled.

Practical implication: replace persistent administrative access with task-scoped access tied to real operational need.

Compliance fails when access and evidence are managed separately

Compliance teams cannot prove control over systems that change faster than review cycles. In practice, the technical gap is not only missing controls, but missing evidence continuity across identity, configuration, and access logs. If engineers can create new instances, secrets, or backdoor paths faster than compliance can observe them, audit readiness becomes a moving target. Secure access therefore has to produce evidence as part of normal operation, not as a retrospective exercise.

Practical implication: build access governance so audit trails, approvals, and revocation records are generated automatically with the access event.

NHI Mgmt Group analysis

Infrastructure access is now an identity governance problem, not a tooling problem. The survey shows that cloud scale, secrets proliferation, and compliance pressure are converging into one control surface. That matters because the security outcome depends less on any single access product and more on whether ownership, revocation, and evidence are governed across humans and NHIs together.

Standing credentials remain the most expensive convenience in modern infrastructure. Teleport’s findings on leaders versus novices reinforce that persistent access is where incident cost and operational drag accumulate. The implication is not simply to reduce access, but to stop treating persistence as the normal state for privileged infrastructure work.

Consolidated identity and unified policy are becoming prerequisites for auditability. When identities, access paths, and policy remain fragmented, compliance becomes an after-the-fact reconstruction exercise. The field is moving toward governance models that can express least privilege, review, and revocation across mixed infrastructure estates without depending on manual coordination.

Infrastructure access security now sits at the intersection of IAM, PAM, and NHI governance. The survey’s strongest signal is that no single team can own the problem end to end if infrastructure, secrets, and privileged access are managed in separate operating models. Practitioners need a shared control plane for access decisions, evidence, and lifecycle management.

Top-performing organisations are showing that access sprawl is a lifecycle issue, not just a hardening issue. The practical lesson is that the real failure mode is unmanaged change across identities and systems, not a lack of security intent. Teams should treat provisioning, review, rotation, and offboarding as one continuous process rather than disconnected tasks.

From our research:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, which shows that the governance model itself is under revision.
• Read Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for the lifecycle controls that turn policy intent into operational governance.

What this signals

Identity programmes that still treat access as a static entitlement are already behind the operating model. Teleport’s findings show that leaders are moving toward consolidated identities, unified policy, and ephemeral privilege because infrastructure change now happens too fast for manual cleanup. The practical signal is that IAM, PAM, and NHI ownership need to converge around one access lifecycle instead of separate process towers.

Standing access will become a measurable governance liability, not just a design weakness. As environments become more dynamic, the organisations that can prove revocation, evidence capture, and policy consistency will separate themselves from those that can only describe intent. For practitioners, that means treating access sprawl as an operating metric, not a periodic remediation project.

For practitioners

• Map every privileged access path Build a register of human, machine, and service access paths across cloud, edge, and on-prem systems. Include standing credentials, ephemeral access mechanisms, secrets, and any backdoor or exception paths so governance can see the full attack surface.
• Eliminate standing privilege where tasks are time-bound Replace persistent admin access with just-in-time access, short-lived credentials, and task-scoped approvals for operational work. Reserve permanent access only for cases where a documented control dependency makes it unavoidable.
• Unify access policy across teams Bring security, engineering, and compliance into one policy model for infrastructure access so controls do not diverge across environments. Use one place to define access rules, review triggers, and revocation conditions.
• Automate evidence collection with access events Ensure approvals, access grants, session records, and revocation actions are captured automatically when access is issued or removed. That reduces audit reconstruction work and closes the gap between control intent and proof.

Key takeaways

• Teleport’s survey shows that infrastructure access has become a broad identity governance problem shaped by credential sprawl, compliance pressure, and DevOps speed.
• Leaders are pulling away by reducing standing privilege, consolidating identities, and unifying policy across humans and machines.
• Practitioners should focus on lifecycle control, evidence generation, and task-scoped access if they want auditability and lower incident exposure.

Key terms

• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Ephemeral Access: Ephemeral access is permission that exists only for the duration of a specific task or session. For agents, it reduces the lifetime of credentials and limits blast radius if a workflow is abused or misrouted. The control is only effective when issuance, expiry, and revocation are enforced automatically.
• Infrastructure Access Security: Infrastructure access security is the control of administrative and operational access to cloud, edge, and on-prem systems. It spans authentication, authorization, privileged access, secrets handling, and audit evidence, so the programme has to manage both productivity and control across changing environments.

What's in the full report

Teleport’s full post covers the operational detail this post intentionally leaves for the source:

• Leader versus novice comparisons showing how mature access programmes reduce incident cost and frequency.
• The survey’s breakdown of where teams are most struggling across cloud, compliance, and DevOps environments.
• Teleport’s recommended access patterns for consolidating identities, policy, and privileged access workflows.

👉 Teleport’s full post covers the survey findings, leader behaviours, and access patterns in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.