TL;DR: Teleport shows that legacy PAM assumptions break down as static credentials, ephemeral resources, multi-cloud complexity, and DevOps automation reshape infrastructure access. Access governance now has to track session-bound identity across human and machine workloads, not just fixed accounts and servers.
At a glance
What this is: This is an analysis of why modern, ephemeral infrastructure weakens legacy privileged access management, with static credentials, scaling churn, and DevOps automation driving the gap.
Why it matters: It matters because IAM, PAM, and NHI programmes now need controls that follow session-bound access across cloud, Kubernetes, and machine workloads instead of relying on static credentials.
👉 Read Teleport's analysis of why modern infrastructure breaks legacy privileged access
Context
Modern privileged access assumes identities and resources stay stable long enough for static policies, long-lived credentials, and manual approvals to work. That assumption fails when infrastructure is ephemeral, access paths multiply, and DevOps automation creates and removes resources faster than legacy PAM can track them.
In this setting, privileged access management is no longer just about protecting administrator logins. It also has to govern human operators, machine identities, and session-scoped authorization across cloud, Kubernetes, databases, and infrastructure-as-code workflows.
The article argues that infrastructure sprawl is not the only issue. The deeper problem is that access control models built for fixed environments cannot reliably govern time-bound, distributed, and automation-driven infrastructure.
Key questions
Q: What breaks when privileged access still depends on long-lived secrets?
A: Long-lived secrets create standing privilege, which means compromise windows stay open long enough for attackers to harvest, reuse, and spread access. They also make lifecycle governance weaker because revocation becomes manual and delayed. In cloud-native environments, that breaks the assumption that access can be safely left in place between tasks.
Q: Why do long-lived secrets increase identity risk in cloud and SaaS environments?
A: Long-lived secrets remain reusable until someone revokes them, which gives attackers a durable target. In cloud and SaaS environments, that means one leaked token or key can be replayed across systems, copied into automation, or reused after the original exposure has faded from view. Short-lived identity reduces that persistence.
A: Common signs include orphaned privileged accounts, repeated screen switching, inconsistent policy enforcement, and manual effort to find who has access to what. If teams cannot quickly discover, vault, and monitor privileged credentials across environments, the control model is lagging. That usually means visibility is incomplete and privilege management is too fragmented for current scale.
Q: How should security teams govern privileged access to databases, servers, and Kubernetes?
A: Security teams should govern privileged access at the resource layer, not only at the perimeter. That means using SSO for identity, just-in-time access for privilege, hidden credentials where possible, and session recording for accountability. The control objective is to reduce standing privilege and preserve evidence for review.
Technical breakdown
Why static credentials fail in ephemeral infrastructure
Static credentials such as passwords, SSH keys, API tokens, and encryption keys create durable access that outlives the resource or task they were meant to protect. In ephemeral infrastructure, that durability becomes a liability because workloads can be created and destroyed faster than administrators can rotate or audit those secrets. Legacy PAM depends on a credential lifecycle that assumes enough stability for storage, rotation, and revocation to keep pace. Modern environments break that assumption, especially when secrets are copied into code, configuration files, or shared storage.
Practical implication: move high-risk access away from long-lived secrets and into session-bound authorization that expires with the task.
How ephemeral certificates change privileged access control
Ephemeral certificates shift privileged access from static secret possession to cryptographic identity issued for a bounded session. That matters because authorization becomes time-scoped, not account-scoped, and revocation happens by design when the session ends. In practice, this aligns access with modern infrastructure patterns where resources appear and disappear continuously. It also reduces the operational burden of rotating credentials across heterogeneous environments, while preserving traceability through session recording and audit logs.
Practical implication: use short-lived credentials and session recording together so authorization and auditability stay aligned as infrastructure changes.
Why DevOps workflows expose PAM compatibility gaps
Modern DevOps depends on automation, infrastructure-as-code, CI/CD pipelines, and fast-moving deployment cycles. Legacy PAM often inserts manual approval steps and separate configuration paths that slow delivery and encourage workarounds. That mismatch creates a governance gap: security controls that are too rigid get bypassed, while controls that are too loose fail to enforce least privilege consistently across cloud, Kubernetes, and on-premises systems. The issue is not DevOps itself, but PAM designs that were never built to integrate with it.
Practical implication: govern access inside delivery workflows rather than forcing engineers to route around security controls.
Threat narrative
Attacker objective: The objective is to turn stale, reusable privileged access into broad control over modern infrastructure and the data it protects.
- Entry begins with exposed static credentials such as passwords, SSH keys, API tokens, or other secrets stored in code, configuration, or shared storage.
- Escalation follows when those long-lived credentials remain valid across changing infrastructure and can be reused after resources or roles shift.
- Impact occurs when attackers or unauthorised insiders use durable access paths to reach cloud workloads, databases, and administrative interfaces across environments.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static credential governance is now a mismatch for ephemeral infrastructure: legacy PAM assumes access can be issued, reviewed, and revoked around stable assets. That assumption breaks when resources are created and destroyed continuously, because the access object often outlives the workload it was meant to protect. The implication is that privileged access governance must shift from account permanence to session-bound control.
Privileged access is now an identity lifecycle problem across humans and machines: the article is not just about administrator convenience or password rotation. It describes a control plane that must manage human users, service access, and machine-initiated sessions across cloud, Kubernetes, databases, and on-premises systems. NIST CSF access governance and OWASP-NHI secret controls both become relevant where static secrets and overbroad entitlements drive exposure.
Ephemeral certificates are a governance pattern, not a feature checklist: time-bounded credentials only matter if they replace standing privilege and leave a defensible audit trail. Session recording, dynamic authorization, and consistent policy enforcement are the real controls that make the model work. Practitioners should judge any access programme by whether it can govern privilege at the moment of issuance, not just after the fact.
Modern DevOps exposes the difference between security theatre and usable control: if privileged access controls block deployment, engineers will route around them. That is why access governance has to fit infrastructure-as-code, CI/CD, and Kubernetes operational reality instead of asking teams to preserve a static server-era model. The field should treat integration with delivery workflows as a core access-control requirement, not an optional convenience.
Identity blast radius is the right way to think about this shift: when secrets, sessions, and resources all move faster than human review cycles, the central question becomes how far any single credential can reach before it expires or is detected. That is a governance boundary problem, not a tooling preference. Practitioners should measure how much access a compromised identity can carry across environments, not just whether it can log in.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: Just-in-Time Access and Zero Standing Privilege Guide
What this signals
Identity blast radius matters more than credential count: the central risk in ephemeral infrastructure is not simply that there are more secrets, but that each one can reach more systems if it is long-lived or reused. A governance model built around short-lived authorization reduces the distance between compromise and impact, which is the control boundary modern infrastructure now demands.
Legacy PAM was built for stable servers, fixed network perimeters, and human-paced administration. Modern environments replace all three assumptions at once, so access policy must follow the workload and the session rather than the host name. That is why privileged access is converging with workload identity and infrastructure lifecycle governance.
When DevOps workflows and access controls are misaligned, engineers will optimise for delivery speed over policy friction. The programme signal is clear: if security cannot fit automation, it will be bypassed in practice, and the organisation will inherit unmanaged privileged paths.
For practitioners
- Replace standing credentials with session-bound access Use short-lived certificates and per-session authentication for administrators, workloads, and automation so access expires when the task ends.
- Map every privileged path to an identity lifecycle owner Assign ownership for human accounts, service accounts, API tokens, and machine credentials so provisioning, review, and offboarding follow the same governance model.
- Audit where secrets still back modern infrastructure Inventory SSH keys, API tokens, passwords, and certificates in code, pipelines, shared storage, and cloud environments, then remove durable secrets where cryptographic identity can replace them.
- Embed access controls into DevOps workflows Align approvals, role binding, and session recording with CI/CD, Kubernetes, and infrastructure-as-code so teams do not bypass security to keep delivery moving.
Key takeaways
- Legacy PAM breaks down when infrastructure is temporary, because controls built for stable assets cannot reliably govern access that appears and disappears with workloads.
- The article links this shift to credential sprawl, complex environments, and DevOps automation, which together expand the opportunity for overexposed privileged access.
- The control answer is session-bound authorization with short-lived credentials, consistent policy across environments, and access patterns that fit modern delivery workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centres on excessive standing privilege in modern infrastructure access. |
| NHI-07 — Long-Lived Secrets | Static passwords, keys, and tokens are the main weakness described in the post. | |
| Recommendation — Reduce standing privilege by issuing short-lived access for users, machines, and automation. Inventory and replace long-lived secrets with ephemeral credentials wherever possible. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential lifecycle management is central to the article's access-control problem. |
| Recommendation — Apply authenticator management controls to rotate, revoke, and bound privileged credentials. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post focuses on how authorization must keep pace with changing infrastructure and sessions. |
| Recommendation — Align entitlements with session-specific authorization across cloud and hybrid environments. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article's risk model maps to stolen secrets being reused across infrastructure. |
| Recommendation — Hunt for exposed credentials that could enable credential access and lateral movement. | ||
Key terms
- Ephemeral Infrastructure: Ephemeral infrastructure refers to short-lived compute resources such as containers, Kubernetes workloads, and serverless components. These identities and access paths can appear and disappear quickly, so governance depends on automated discovery, tight permissions, and lifecycle-aware auditing.
- Ephemeral certificate: A short-lived digital credential issued for a current session rather than stored for long-term reuse. In connected OT environments, ephemeral certificates reduce the value of stolen credentials and provide a cleaner control point for remote authentication and revocation.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Session-bound authorisation: Authorisation that follows a verified runtime session rather than a process name or static allowlist. In agentic environments, it means the actor must prove identity at execution time before tool use or network access is granted, which is stronger than trusting the binary path alone.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- Examples of how ephemeral certificates replace static credentials across cloud, Kubernetes, and database access
- The article's own breakdown of why legacy PAM patterns struggle with multi-cloud, on-premises, and infrastructure-as-code environments
- More detail on session recording, audit logging, and how Teleport applies role-based access control in practice
- The specific DevOps workflow integrations discussed in the source article, including CI/CD and automation touchpoints
Deepen your knowledge
NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org