TL;DR: Passwords, SSH keys, API keys, and other static privileged credentials remain easy to reuse, share, and expose, which keeps escalation paths open even when rotation policies exist, according to SSH Communications Security. The real shift is away from maintaining secrets that should not persist at all, toward temporary, policy-driven access that removes standing privilege rather than preserving it.
At a glance
What this is: This is an argument for keyless privileged access, with the core finding that static privileged credentials keep undermining PAM even when rotation and vaulting are in place.
Why it matters: It matters because IAM and PAM teams need to stop treating privileged access as a secret-management problem and start treating it as a standing-privilege reduction problem across human, service, and automation paths.
Context
Privileged access still depends too heavily on passwords, SSH keys, API keys, and other static secrets that were designed for persistence, not temporary elevation. The governance gap is that access often outlives the task, so teams spend time rotating credentials after exposure instead of preventing durable exposure in the first place.
In cloud, production, CI/CD, and automation environments, access is often needed for minutes rather than days. That makes standing privilege and long-lived credentials a poor fit for how modern infrastructure actually operates, especially when multiple teams and systems share the same access paths.
Key questions
Q: What breaks when privileged access is managed with static keys instead of just-in-time access?
A: Static keys create standing access that is harder to govern, rotate, and revoke, especially in fast-moving production systems. When access persists beyond the task, organisations increase exposure to credential misuse, overprivilege, and compliance gaps. Just-in-time access narrows that window by issuing permissions only for the approved action and then removing them.
Q: Why do certificates create risk in cloud and automation environments?
A: Certificates create risk when they outlive the workloads, pipelines, or data paths they were meant to protect. In cloud and automation environments, that persistence is easy to overlook because issuance and renewal are often fragmented. The practical problem is unmanaged trust, where a certificate still authenticates something even after the original governance decision has expired.
Q: How do teams know whether keyless privileged access is actually reducing risk?
A: They should look for a smaller population of persistent privileged credentials, fewer credentials embedded in automation, and more access granted only at request time. If sessions still depend on copied passwords or keys, the programme has not moved far enough from secret management to access governance.
Q: Should organisations replace secret rotation with ephemeral privileged access?
A: Rotation still has value, but it should not be the main control if the organisation is still distributing static credentials. The better test is whether privileged access can be issued without leaving a reusable secret behind. If not, rotation is compensating for a design problem rather than solving it.
Technical breakdown
Why standing privileged credentials fail in dynamic environments
Traditional privileged access assumes the credential is the control point, so the system protects a password or key and then monitors its use. That breaks down when access is needed briefly across rapidly changing targets, because the credential becomes a reusable artifact that can be copied, shared, or left behind. Static SSH keys and passwords also blur ownership, since the same secret may end up embedded in scripts, automation, and operator workflows. The result is credential sprawl and a persistent attack surface rather than a governed access model.
Practical implication: reduce the number of persistent privileged credentials and treat every reusable secret as a governance liability.
How keyless privileged access changes PAM architecture
Keyless privileged access shifts the control plane from stored secrets to policy decisions. Instead of distributing long-lived credentials, access is issued just for the required identity, target, and duration, then removed when the session ends. That aligns privileged access with Zero Standing Privilege, because the system no longer depends on a secret surviving long enough to be abused later. In practice, the important architectural change is that authorization happens at request time, not through a permanently reusable authenticator.
Practical implication: move privileged access decisions to issuance time and verify that no standing credential remains after the session closes.
Why passwordless is not enough without keyless controls
Passwordless access improves privileged security, but it does not solve the broader problem if SSH keys, API keys, and other static authenticators still exist elsewhere in the environment. Those credentials can be copied, distributed, and reused just like passwords, which means the organisation still carries residual privilege it cannot reliably govern. The real control objective is therefore not simply removing one credential type, but removing persistent authenticators from the privileged path entirely. That is the distinction between reducing friction and reducing exposure.
Practical implication: review privileged workflows for leftover static keys and replace them with ephemeral, policy-based access where possible.
Threat narrative
Attacker objective: The attacker wants durable privileged access that can be reused across systems and environments without triggering immediate detection or revocation.
- Entry occurs when attackers obtain a reusable privileged credential such as a password, SSH key, or API key from a shared system, script, or exposed workflow.
- Privilege escalation follows because the stolen credential already carries elevated access, allowing the attacker to move into administrative or production contexts without starting from a low-privilege foothold.
- Lateral movement becomes easier because the same static credential is often reused across systems, teams, or environments, widening the reachable attack surface.
- Impact occurs when the attacker uses that privileged access to alter systems, access sensitive resources, or expand control over critical infrastructure.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Standing privileged credentials are the wrong primitive for modern access governance: passwords and static keys were built to persist, while modern privileged tasks are often ephemeral. That mismatch creates governance debt, because teams keep managing secrets that should have been eliminated from the path entirely. The practitioner conclusion is to treat standing privilege as the real issue, not just credential hygiene.
Keyless access is really a Zero Standing Privilege decision: once access is issued by identity, policy, and context, the control objective changes from protecting a reusable secret to removing persistence. That is a stronger model for cloud and automation-heavy estates because it reduces the lifetime of any privileged authority. Practitioners should evaluate whether their PAM architecture still depends on secrets that can be copied and reused.
Static SSH keys and API keys are governance blind spots, not just operational convenience: they often survive longer than their intended use, and their distribution makes ownership unclear. That makes offboarding, review, and revocation harder than they appear on paper. The field implication is that privileged access programmes must account for every persistent authenticator, not only passwords.
Keyless privileged access sharpens the boundary between authentication and authorization: authentication should establish identity, while authorization should decide whether elevated access is granted for this request, this target, and this duration. When that boundary is clear, privileged access becomes auditable in a way secret-based models rarely are. Practitioners should redesign controls around issuance and session governance instead of secret retention.
Modern PAM is becoming an access-minimisation discipline rather than a vaulting discipline: storing credentials securely is still useful, but it is no longer the main control objective for privileged access. The market direction is toward systems that reduce how many privileged credentials exist at all. Security leaders should re-evaluate whether their programme is preserving secrets or removing them.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: Just-in-Time Access and Zero Standing Privilege Guide
What this signals
Keyless privileged access: the important shift is not only away from passwords, but away from any durable authenticator that can be copied into automation, shared across teams, or left behind after the task ends. That is why standing privilege is becoming the more useful lens than secret type when teams assess PAM.
Access review processes do not fix persistent secrets: a credential that lives too long cannot be made safe simply because it is reviewed periodically. The control boundary moves to issuance time, where identity, context, and duration can be enforced before access exists.
Operationally, organisations should expect privileged access governance to converge with Zero Standing Privilege patterns, because the combination of ephemeral access and auditable sessions gives better control than preserving reusable credentials.
For practitioners
- Reduce standing privileged credentials Inventory passwords, SSH keys, API keys, and other reusable authenticators that still grant elevated access. Remove or replace any credential that persists beyond the task it supports.
- Shift privileged access to policy-based issuance Require identity, context, and target-specific policy checks before granting elevated access, and make the session ephemeral so no reusable secret remains afterward.
- Map credential sprawl across automation paths Trace where secrets are embedded in scripts, CI/CD pipelines, containers, and shared admin tooling, because those are the paths where long-lived access tends to persist unnoticed.
- Audit privileged sessions for recoverable secrets Record and review privileged sessions so teams can see when access was granted, what it touched, and whether the workflow still depends on a copied credential.
Key takeaways
- Static privileged credentials remain an access-governance problem even when organisations invest in rotation and vaulting.
- The practical shift is from preserving secrets to issuing temporary, policy-based privileged access with no standing credential left behind.
- Teams that still rely on reusable passwords or keys for privileged work are managing exposure after the fact instead of reducing it at the source.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excessive standing privilege in privileged access paths. |
| NHI-07 — Long-Lived Secrets | Passwords, SSH keys, and API keys are the persistent secrets the article argues against. | |
| Recommendation — Reduce standing privileged access and issue elevation only for the target, task, and duration required. Eliminate long-lived privileged secrets and replace them with ephemeral access mechanisms. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | IA-5 governs the lifecycle of authenticators, including rotation and removal of privileged credentials. |
| Recommendation — Apply authenticator lifecycle controls to retire persistent privileged credentials rather than rotating them indefinitely. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about reducing persistent permissions and issuing access by policy. |
| Recommendation — Tighten privileged entitlements so access is granted only through policy-based authorization. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article explicitly links compromised privileged credentials to escalation and lateral movement. |
| Recommendation — Map reusable privileged credentials to credential-access and lateral-movement risk in your detections and hardening work. | ||
Key terms
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Keyless Privileged Access: Keyless privileged access is a model for granting elevated access without distributing a reusable static secret such as a password or SSH key. The access decision is made through identity and policy at request time, which reduces secret persistence and improves auditability.
- Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
- Privileged Session: A live authenticated connection that can perform sensitive actions without re-entering credentials. For NHIs and admins alike, the risk is not only who signed in, but what authority the session carries before it expires or is revoked. Session control is therefore a practical security boundary.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 7, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org