TL;DR: Akeyless argues that hybrid and multi-cloud privileged access is outgrowing VPNs, bastions, and shared admin accounts because dynamic infrastructure now demands identity-based access, just-in-time credentials, session recording, and post-session revocation. The security model fails when access is granted to the network instead of the target, because governance cannot keep pace with changing infrastructure.
At a glance
What this is: This is an analysis of modern PAM for hybrid cloud, showing why identity-based access, short-lived credentials, and session control are replacing network-centric VPN access models.
Why it matters: It matters because IAM, PAM, and NHI teams need controls that follow the target and the session, not a static perimeter that no longer matches cloud-era infrastructure.
👉 Read Akeyless's analysis of modern PAM for hybrid cloud identity trust
Context
Modern PAM in hybrid cloud is about controlling privileged access when the infrastructure is elastic, distributed, and no longer anchored to a fixed network perimeter. In that environment, VPNs, bastions, and shared admin accounts create access that is broader than the task requires and harder to revoke cleanly.
The governance problem is not just connectivity. It is whether access can be bound to identity, scoped to the target, and removed when the session ends. That makes this topic relevant to PAM, NHI governance, and cloud access design at the same time.
Key questions
Q: What breaks when privileged access still depends on VPNs and bastion hosts in hybrid cloud?
A: VPNs and bastions tend to grant broad network reach instead of task-scoped access to a single target. In hybrid cloud, that creates excess privilege, makes revocation slower, and leaves teams relying on perimeter assumptions that no longer match how infrastructure is built or changed.
Q: Why do shared admin accounts and long-lived credentials increase risk in modern PAM?
A: They extend the lifetime of privileged trust beyond the session and make offboarding imperfect. If credentials can be reused, leaked, or forgotten after a contractor leaves, the environment retains access paths that no longer have a current operational need or clear owner.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay. If the organisation can only show approvals but not downstream revocation, the review is administrative recordkeeping rather than governance. Proof of removal is the best maturity signal.
Q: What is the difference between identity-based access and network-based access for PAM?
A: Identity-based access authorises a specific person for a specific target and time window, while network-based access authorises movement inside a trusted segment. In modern environments, the first model limits blast radius and supports better revocation, while the second often exposes more than the task requires.
Technical breakdown
Why network trust breaks in hybrid cloud PAM
Traditional privileged access assumes the network is a stable control boundary. Once workloads move across AWS, Azure, GCP, and on-prem environments, that assumption fails because targets appear and disappear, addresses change, and access paths need to be granted and removed continuously. VPN-style access typically expands the blast radius because it authorises a route, not a single task on a single system. Modern PAM shifts the decision point from the perimeter to the identity, target, and session. That allows policy to follow the resource rather than the network segment and makes revocation meaningful when infrastructure is ephemeral.
Practical implication: Design privileged access around target-scoped identity controls rather than perimeter access paths.
How credential injection and JIT access change the control model
Credential injection replaces user-visible passwords with temporary, policy-issued credentials, while just-in-time access limits the lifetime of those credentials to the approved session. In practice, that means the privileged identity exists only long enough to complete the task and can be rotated or revoked immediately afterwards. This is materially different from shared admin accounts or long-lived service logins, which create a persistent trust problem. The control value comes from reducing standing privilege and removing reusable secrets from the operator workflow, not from making login more convenient.
Practical implication: Use short-lived credentials and post-session rotation to eliminate standing privileged access.
What session recording adds to privileged access governance
Session recording turns privileged activity into an auditable event stream. For SSH, RDP, databases, and browser-based admin sessions, recording provides evidence of what actions were taken, by whom, and against which target. That matters because privileged access is not only about entry control, but also about accountability after the connection is established. When combined with identity-based authorization and automatic revocation, recording helps close the governance gap between access approval and actual administrative behaviour. It is especially relevant where contractors, vendors, and temporary operators need elevated access without receiving permanent accounts.
Practical implication: Record privileged sessions wherever elevated access must be justified, reviewed, or investigated later.
Threat narrative
Attacker objective: The objective is to obtain broad privileged reach across hybrid infrastructure and retain access longer than the task justifies.
- Entry begins when a contractor, vendor, or administrator receives broad VPN or bastion access instead of target-specific access, exposing more of the environment than the task requires.
- Credential exposure or misuse follows because shared admin accounts, long-lived credentials, or weak offboarding leave active access paths in place after the work is done.
- Impact occurs when those stale or overbroad privileges are reused to reach systems that should have been isolated, making revocation slow and blast radius larger than necessary.
Breaches seen in the wild
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
- Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity trust is now the governing model for privileged access in hybrid cloud. Network trust presumes a stable perimeter, but hybrid infrastructure changes too quickly for that assumption to hold. The practical implication is that PAM has become an identity decision problem, not a connectivity problem.
Standing privileged access is the wrong default for elastic infrastructure. When targets scale up and down across cloud and on-prem environments, any access that persists beyond the session becomes governance debt. The implication is that privilege should be issued and removed with the task, not maintained as a reusable entitlement.
Session evidence is now part of privileged control, not an audit afterthought. If administrators, contractors, and vendors can operate through the same access path, the system needs traceability built into the workflow. The implication is that recording, authorization, and revocation should be treated as one control surface.
Ephemeral credential trust debt: Modern PAM still inherits the assumption that administrators can be given reusable access and later reviewed or offboarded cleanly. That assumption weakens when cloud targets are dynamic and credentials are injected just in time, because the trust decision and the access window collapse together. The implication is that governance has to move from review-after-grant to control-at-issuance.
Modern PAM will consolidate around identity, secrets, and session control. Point solutions that only broker connections leave teams stitching together revocation, recording, and credential management elsewhere. The implication is that practitioners should expect platform designs to keep collapsing these functions into a single privileged access workflow.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: Privileged Access Management Guide
What this signals
Identity-based PAM now has to absorb what the perimeter used to do. Hybrid cloud breaks the old separation between network control and privileged control, so teams need access policies that bind identity to the target and the session rather than to a trusted subnet. That shift changes how access reviews, revocation, and audit evidence should be designed.
Modern PAM is converging on a control bundle, not a single feature. Credential injection, session recording, and just-in-time access work together because no one control is enough once infrastructure is elastic. Teams that keep these functions separate will keep paying governance overhead in the form of stitching, exceptions, and delayed offboarding.
For practitioners
- Replace network-based privileged access with target-scoped authorization Define privileged access around the exact server, database, cluster, or console a user needs, then remove VPN-style broad reach where possible. Policy should follow identity, target, and session duration rather than inherited network membership.
- Eliminate standing admin credentials Use short-lived credentials, automatic rotation, and just-in-time issuance for administrative tasks so users do not operate with reusable passwords or shared accounts.
- Require session recording for elevated access Record privileged SSH, RDP, database, and browser-based administrative sessions so approvals can be matched to observed actions during review or incident response.
- Tighten contractor and vendor offboarding Track which firewall rules, jump box permissions, VPN groups, and temporary accounts were created for third parties, then verify that each one is removed when the engagement ends.
Key takeaways
- Hybrid cloud privilege cannot be governed reliably with perimeter-era controls because network access is too broad for dynamic infrastructure.
- The operational pattern that matters is target-scoped identity, short-lived credentials, and recorded sessions that can be revoked cleanly.
- Teams that still rely on shared admin access and manual offboarding will keep accumulating access they cannot confidently explain or remove.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excessive privileged reach in hybrid access paths. |
| NHI-07 — Long-Lived Secrets | The article contrasts long-lived admin access with short-lived, injected credentials. | |
| NHI-01 — Improper Offboarding | The post highlights the difficulty of removing all access created for contractors and vendors. | |
| Recommendation — Reduce standing privileged reach by scoping access to the specific target and session. Replace reusable administrative secrets with just-in-time credentials and automatic rotation. Verify that every third-party access path is revoked when the engagement ends. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Broad admin access and stale credentials expand credential abuse and movement paths. |
| Recommendation — Map privileged access exposure to credential-access and lateral-movement risk during reviews. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who can access which privileged target. |
| Recommendation — Enforce target-specific entitlements and remove broad network-level authorisations. | ||
Key terms
- Identity trust: The set of assumptions an environment makes about how a user, device, or service proves who it is. When those assumptions are weak, attackers can enter through valid authentication instead of breaking infrastructure, which turns identity into the primary attack surface.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
- Session Recording: Session recording is the capture of user activity during a privileged session, such as commands, queries, or administrative actions. It gives security and audit teams a verifiable record of what happened after authentication, which is essential when access itself is not enough to prove control.
- Credential Injection: Credential injection is the controlled replacement of one credential with another at execution time, usually before a request leaves the host or service boundary. It lets the workload operate with a harmless token or placeholder while the real secret remains protected by infrastructure.
What's in the full article
Akeyless's full article covers the implementation detail this post intentionally leaves for the source:
- Step-by-step comparison of Boundary and Akeyless target handling across SSH, RDP, databases, Kubernetes, and cloud consoles
- Feature-level walkthroughs of credential injection, session recording, and just-in-time access in real administrative workflows
- Practical differences between dynamic host discovery and unified privileged access for teams operating across AWS, Azure, GCP, and on-prem
- Demo-specific examples of how temporary users, short-lived certificates, and live revocation behave during active sessions
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org