TL;DR: Teleport’s 2024 survey of 250 security and engineering leaders finds that 89% of organisations have suffered at least one security incident in the past three years, while 88% say credentials and secrets proliferation is making infrastructure access security harder and 86% cite regulatory compliance as a major challenge. The real issue is that access governance now has to span security, engineering and compliance as one operating model, not three separate ones.
At a glance
What this is: This survey-based analysis argues that infrastructure access security is becoming harder as cloud sprawl, credentials growth and compliance pressure converge, with Teleport reporting high incident rates and widespread difficulty managing access.
Why it matters: IAM, PAM and NHI teams need to treat infrastructure access as a cross-functional governance problem because the failure mode is no longer just access control, but fragmented accountability across humans, machines and delivery pipelines.
By the numbers:
- 89% of organisations have suffered at least one security incident in the past three years, according to Teleport’s survey.
- 88% say credentials and secrets proliferation makes infrastructure access security harder, according to Teleport’s survey.
- 86% cite regulatory compliance as a major challenge, according to Teleport’s survey.
- Over 74% of survey respondents said infrastructure access security has grown increasingly challenging.
👉 Read Teleport’s analysis of why secure infrastructure access must evolve
Context
Modern infrastructure access security is the problem of controlling who or what can reach systems, tools and environments without creating a permanent attack path. In this survey, Teleport argues that cloud growth, identity-based attacks, remote work and compliance obligations have pushed that problem beyond traditional IT ownership.
The governance gap is that access is now fragmented across humans, service accounts, ephemeral infrastructure and DevOps pipelines, yet many programmes still treat it as separate operational tasks. That mismatch creates credential sprawl, audit friction and inconsistent policy enforcement across the stack.
The article’s core claim is that access security can no longer be managed as a narrow control layer. It has become a cross-functional identity governance issue that directly affects delivery speed, resilience and auditability.
Key questions
A: The organisation loses a single source of truth for who can access what, when access expires, and how evidence is produced. In that model, engineers optimise for speed, security optimises for control, and compliance optimises for proof, but no team can reliably show the full picture across the access lifecycle.
Q: Why do credentials and secrets create so much risk in modern infrastructure?
A: Because each credential or secret is both an access path and a lifecycle obligation. As cloud services, pipelines, and integrations multiply, the number of places where credentials can be exposed, reused, or forgotten grows faster than manual review can keep up, which increases the likelihood of unauthorized access and compliance gaps.
Q: What are the signs that privileged infrastructure access is poorly governed?
A: Common signs include unmanaged admin interfaces, inconsistent ownership of firewall or router consoles, direct internet exposure, and patch state that is tracked separately from privileged access records. If a team cannot name who should administer the device, it is already behind on governance.
A: They should move to a shared operating model with one policy baseline, one evidence model and one revocation process. That does not eliminate specialist responsibilities. It stops access governance from fragmenting into separate decisions that produce contradictory results in production.
Technical breakdown
Why cloud-scale access control becomes harder as environments fragment
Cloud infrastructure expands the number of entry points, identities and policy surfaces that must be governed at once. When teams add edge systems, remote endpoints and ephemeral workloads, access control stops being a single perimeter question and becomes a distributed identity problem. The practical issue is not only authentication, but lifecycle control over every path that can be used to reach infrastructure. Once those paths are created faster than they are reviewed, policy drift becomes structural rather than accidental.
Practical implication: map every infrastructure access path, including ephemeral and machine-mediated paths, to a single governance model.
How credentials and secrets proliferation changes the risk model
Credentials and secrets are the practical currency of infrastructure access, and the survey says their growth is one of the main reasons access security is harder. Hard-coded secrets in config files, backdoor access paths and pipeline shortcuts all reduce friction for delivery teams while increasing the number of exploitable trust points. In NHI terms, this is a lifecycle problem: secrets are issued, copied, reused and left standing long after the original need has passed. That creates a larger blast radius than the underlying workload or application would otherwise require.
Practical implication: treat every secret as a governed identity artifact with issuance, scope, rotation and revocation rules.
Why compliance becomes harder when access is embedded in delivery workflows
Compliance teams are not just proving that controls exist. They are proving that controls remain current while developers spin up resources, ship code and change access paths continuously. That means access governance must be auditable at the same pace as engineering, or evidence collection lags behind reality. The survey’s emphasis on regulatory compliance reflects a common failure mode: controls that look sound on paper but cannot be demonstrated across fast-moving infrastructure. In practice, access review and audit readiness have to be designed into the delivery model, not bolted on afterwards.
Practical implication: build audit evidence and access review into the workflow that creates and changes infrastructure, not a separate review cycle.
Threat narrative
Attacker objective: The objective is to gain and expand infrastructure access while staying inside the organization’s fragmented identity and compliance gaps.
- Entry occurs through proliferating infrastructure access paths, including cloud, edge and IoT silos that expand the attack surface faster than governance can absorb.
- Credential access follows when secrets are hard-coded, reused or left standing in config files and delivery pipelines.
- Escalation happens as backdoor paths and overbroad access make it easier to move from a single foothold to broader infrastructure control.
- Impact is realised through compromise of operational systems, audit failure and increased incident exposure across the environment.
Breaches seen in the wild
- EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.
- CI/CD pipeline exploitation case study: Credentials in an exposed .git/config let a researcher edit a Bitbucket pipeline so it planted their SSH key on the server. No victim was named.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Infrastructure access has become a governance problem, not a tooling problem. Teleport’s survey is really describing the collapse of the old assumption that access can be managed inside one team or one control plane. Once humans, machines, secrets and delivery workflows all create access paths, the unit of governance is the full access lifecycle. The practitioner conclusion is to govern access as an operating model, not as an isolated admin function.
Credential and secrets sprawl is the clearest NHI signal in the article. The article’s 88% figure points to a classic NHI control failure: secrets are being treated as disposable implementation detail rather than as identities with scope and ownership. That is why standing access keeps leaking into infrastructure workflows. The practitioner conclusion is that any infrastructure access programme that cannot inventory and revoke secrets at the same speed it issues them will keep accumulating hidden trust.
Cross-functional access governance is now the real maturity marker. The survey’s emphasis on security, engineering and compliance reflects a market shift away from siloed access administration. This aligns with NIST CSF 2.0 governance and access control expectations, but the article’s unique contribution is showing that the control failure is organisational, not just technical. The practitioner conclusion is that programme maturity now depends on shared policy, shared evidence and shared ownership across teams.
Ephemeral access reveals the identity blast radius problem. The more modern infrastructure becomes, the more the blast radius is determined by how long access can remain standing after it is no longer needed. Identity blast radius: the amount of infrastructure a credential can reach before governance catches up. That concept matters because a short-lived workload can still create long-lived exposure if its secrets are copied into pipelines, configs or backdoor paths. The practitioner conclusion is to measure access by reach and persistence, not by whether a control exists in principle.
Teleport’s leaders-versus-novices framing shows that access governance is an outcome discipline. The article ties stronger access practices to fewer incidents and lower incident costs, which means mature programmes are defined by fewer exploitable paths, not by more review activity. That distinction matters for senior IAM and PAM teams because it shifts attention from process volume to trust reduction. The practitioner conclusion is to judge the programme by how much standing access it removes from real infrastructure.
What this signals
Credential sprawl is now a governance signal, not just an operational nuisance. When infrastructure access depends on secrets scattered across configs, pipelines and cloud silos, the real risk is that no single team can see the full trust surface. That is the point where access review stops being a periodic control and becomes a lifecycle discipline.
Identity blast radius is the right lens for modern infrastructure access. The question is no longer whether an access path exists, but how far it can reach before revocation catches up. Programmes that can shorten that radius by removing standing access and centralising policy will be easier to audit and harder to abuse.
For practitioners
- Inventory every infrastructure access path Map human, machine, pipeline and emergency access paths across cloud, edge and on-prem environments so that policy coverage reflects how systems are actually reached.
- Eliminate standing privileges from infrastructure workflows Replace persistent credentials and broad backdoor paths with ephemeral access tied to the specific task, environment and operator context.
- Pull secrets out of config files and pipelines Find hard-coded credentials in application configs, CI/CD variables and deployment scripts, then move them to governed secret handling with revocation ownership.
- Unify audit evidence with access changes Make access approvals, privilege changes and revocations produce evidence automatically so compliance teams can verify controls without chasing separate records.
- Define one policy model for security and engineering Align access rules, exception handling and review ownership so delivery teams and security teams work from the same control baseline rather than separate assumptions.
Key takeaways
- Infrastructure access now fails when identity, engineering and compliance are treated as separate governance problems.
- The survey points to a large control gap around credentials and secrets proliferation, which creates persistent access paths across modern infrastructure.
- The practical answer is to govern access as a lifecycle problem, with shared policy, revocation and audit evidence across all infrastructure touchpoints.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Hard-coded secrets and copied credentials are central to the article’s access risk. |
| NHI-05 — Overprivileged NHI | Standing access and broad backdoor paths increase the blast radius of infrastructure compromise. | |
| NHI-07 — Long-Lived Secrets | The article’s leaders-versus-novices theme depends on replacing standing credentials with ephemeral access. | |
| Recommendation — Scan infrastructure workflows for leaked secrets and revoke exposed credentials immediately. Reduce privilege scope for machine and infrastructure identities to the minimum task reach. Replace persistent infrastructure credentials with short-lived, task-scoped credentials. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing access permissions across distributed infrastructure. |
| Recommendation — Centralise entitlement governance so access changes are reviewable across all infrastructure paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and access path management are core to the survey’s findings. |
| Recommendation — Apply account management controls to remove stale access and backdoor paths from infrastructure. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article’s risk model maps directly to credential access followed by expanded infrastructure movement. |
| Recommendation — Map exposed credentials and broad access paths to credential access and lateral movement detection. | ||
Key terms
- Infrastructure Access Security: Infrastructure access security is the control of administrative and operational access to cloud, edge, and on-prem systems. It spans authentication, authorization, privileged access, secrets handling, and audit evidence, so the programme has to manage both productivity and control across changing environments.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Credential Sprawl: Credential sprawl is the uncontrolled accumulation of machine secrets, keys, and tokens across systems, teams, and environments. It usually starts with a single use case and ends with overlapping permissions, unclear ownership, and a larger attack surface than the organisation expected.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
What's in the full report
Teleport’s full blog post covers the operational detail this post intentionally leaves for the source:
- Survey framing and respondent breakdown for the 250 security and engineering leaders behind the findings
- Leader-versus-Novice comparisons that show how stronger access practices change incident cost and incident frequency
- Operational examples of how teams are consolidating identities, removing standing privileges and unifying policy
- The article’s full discussion of why compliance, productivity and security need one access model rather than three
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org