TL;DR: Acquisition-driven uncertainty in the PAM market is exposing a deeper problem: traditional privileged access controls were built for static infrastructure, while cloud-native systems and ephemeral workloads demand dynamic, context-aware authorization, according to SGNL. The practical question is no longer whether PAM remains useful, but where it stops being sufficient for cloud and NHI governance.
At a glance
What this is: This is an analysis of how PAM vendor acquisitions are exposing the limits of static privileged access models in cloud-native environments.
Why it matters: It matters because IAM and PAM teams need access governance that covers ephemeral infrastructure, developer workflows, and hybrid estates without relying on assumptions built for long-lived servers.
Context
PAM is a control model for granting and supervising elevated access, but it was designed around long-lived systems and predictable admin workflows. In cloud-native environments, that design runs into ephemeral workloads, infrastructure-as-code, and fast-moving developer pipelines, where access decisions must keep pace with runtime context.
SGNL frames the current acquisition wave as more than vendor noise. The deeper issue is whether a PAM-centric programme can still govern access across cloud platforms, Kubernetes, serverless functions, and customer-facing applications without pushing teams toward static secrets or workarounds.
The article’s core message is that the access gap predates the acquisition news. Consolidation simply makes the roadmap question unavoidable for organisations already feeling friction between privileged access governance and cloud velocity.
Key questions
Q: When does traditional PAM become a poor fit for cloud-native environments?
A: Traditional PAM becomes a poor fit when each new resource type requires specialist configuration, extra services, or separate operational workflows. At that point, access control is no longer keeping pace with the environment it is meant to govern. That mismatch is especially visible in hybrid estates where databases, servers, and Kubernetes all need consistent oversight.
Q: Why do cloud teams bypass privileged access controls?
A: Cloud teams bypass privileged access controls when the approved path is too slow or awkward to fit delivery workflows. If security forces users out of CLI, GitOps, or automation tooling, teams often choose convenience over governance and reintroduce unmanaged secrets to keep work moving.
Q: How can IAM teams know when PAM coverage is too fragmented?
A: PAM coverage is too fragmented when access decisions and policy enforcement differ materially across cloud providers and on-premises systems. A good indicator is when one environment has strong controls while another relies on local exceptions, giving the appearance of central governance without consistent enforcement.
Q: Should organisations prioritise continuous identity before replacing IGA or PAM?
A: Yes. The article's logic is that continuous identity should augment existing IGA and PAM rather than force replacement. Organisations get more value by making current entitlements and privileged workflows responsive to runtime conditions than by adding another parallel identity system that still cannot see live context.
Technical breakdown
Why static PAM models struggle with ephemeral cloud access
Traditional PAM was built to broker privileged access to servers, administrative accounts, and other long-lived assets. Ephemeral cloud resources such as Kubernetes pods and serverless functions change the problem: the identity exists only briefly, the access window is short, and the control point often needs to sit at request time rather than session time. In that environment, pre-provisioned credentials and manual approval flows become a poor fit because the resource may disappear before the workflow completes. The architecture needs dynamic authorisation, not just privileged credential management.
Practical implication: treat ephemeral workloads as a different access class and evaluate whether your PAM flow can authorise at runtime, not only before login.
How developer workflow friction turns security policy into shadow secrets
When access controls force developers out of their native tools, security policy often loses to delivery pressure. If the path to access is slow or cumbersome, teams look for faster options, which can mean static secrets, local exemptions, or embedded credentials in code and pipelines. That is not a compliance edge case; it is a design failure in the access model. The real control question is whether the governance flow can live inside CLI, GitOps, and automation-first delivery without creating an incentive to bypass it.
Practical implication: validate that privileged access controls fit developer tooling natively, or you will keep creating unmanaged credential paths.
Why hybrid access visibility breaks when PAM stays siloed
A PAM-centric view can fragment quickly when the environment spans cloud providers and on-premises infrastructure. Each domain may have different policy engines, identity lifecycles, and enforcement points, so the organisation sees access through separate lenses instead of one governed model. That fragmentation matters because inconsistent policy enforcement often looks like coverage on paper while hiding weak spots in cloud accounts, infrastructure-as-code, and customer-facing applications. The problem is not just control presence, but control coherence across environments.
Practical implication: assess access governance as an estate-wide model and check whether policy decisions remain consistent across cloud and on-premises boundaries.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Vendor consolidation is exposing an access architecture problem, not just a procurement problem. When a PAM roadmap becomes uncertain, the real question is whether the current governance model can still handle cloud-native reality. Organisations that treat the acquisition as only a vendor-management event miss the deeper issue: static privileged access assumptions are colliding with dynamic infrastructure. The practitioner conclusion is to evaluate access architecture, not just vendor stability.
Continuous Identity is a response to context-driven access, not a replacement slogan for PAM. The article’s useful insight is that cloud-native environments require authorisation decisions that move with identity, device posture, business context, and data sensitivity. That is a different operating model from pre-approved tickets and long-lived privileged sessions. The implication is that PAM remains relevant, but only as one part of a broader access strategy.
Cloud-native access gaps are governance gaps before they become tooling gaps. If access workflows push teams toward static secrets or external workarounds, the organisation has already lost control of the operating model. This is where identity architecture, developer experience, and policy enforcement intersect. Practitioners should focus on whether their controls can be adopted without friction, because unusable governance becomes bypassed governance.
Cloud access is now a lifecycle problem across human, workload, and machine identity. The same programme that protects administrator sessions must also account for ephemeral infrastructure, API-driven access, and hybrid policy boundaries. That makes access governance a cross-domain discipline, not a PAM-only exercise. The practitioner conclusion is to align governance design to the full access lifecycle, not the narrowest inherited control model.
From our research library:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
What this signals
Continuous access design is becoming the differentiator, not the ownership model of a legacy PAM stack. If governance still depends on static credential workflows, cloud programmes will keep accumulating exceptions that are invisible until something breaks. Practitioners should expect access architecture to be judged by how well it supports ephemeral infrastructure and automation-first delivery.
Policy has to move closer to the point of execution. In cloud-native estates, the useful control is the one that can evaluate current identity, context, and workload state before access is exercised. That shifts IAM teams away from approval-centric operating models and toward runtime authorisation design.
For practitioners
- Assess PAM fit against ephemeral workloads Map Kubernetes pods, serverless functions, and other short-lived resources against your current privileged access workflows to identify where session-based controls no longer match the asset lifecycle.
- Eliminate developer friction in access paths Check whether developers must leave CLI, GitOps, or automation workflows to request access, because that friction often drives static secret workarounds and policy bypasses.
- Inventory cloud-native privileged access blind spots Review where policy enforcement differs across cloud providers, on-premises systems, and customer-facing applications so you can see where access governance becomes fragmented.
- Redesign authorisation around real-time context Shift high-risk access decisions toward identity, device posture, business context, and data sensitivity so the control point reflects current conditions rather than pre-approved tickets.
- Re-evaluate vendor roadmap dependence Document which access governance capabilities you rely on from the acquired PAM platform and which cloud-native controls must be handled elsewhere if the roadmap diverges.
Key takeaways
- PAM acquisitions are surfacing a pre-existing governance gap between static privileged access controls and cloud-native operating conditions.
- The article points to friction in developer workflows, ephemeral resources, and hybrid policy enforcement as the main places where access control breaks down.
- IAM teams should evaluate whether their current privileged access model can govern runtime context, or whether it is already driving shadow secrets and fragmented enforcement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Cloud-native access gaps often start where static privilege exceeds workload scope. |
| NHI-07 — Long-Lived Secrets | Static secrets commonly appear when PAM workflows do not fit ephemeral cloud delivery. | |
| NHI-08 — Environment Isolation | Hybrid and cloud-native estates need distinct boundaries because one PAM model rarely fits every environment. | |
| Recommendation — Limit workload and service access to the minimum runtime scope and remove standing excess privilege. Replace long-lived credentials with shorter-lived alternatives wherever workflow pressure creates secret sprawl. Separate policy boundaries so cloud, code, and on-premises access do not collapse into one weak control plane. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article is about credential lifecycle and the limits of existing authenticator management in cloud settings. |
| Recommendation — Use IA-5 to enforce credential issuance, rotation, and revocation across hybrid access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The central problem is keeping access permissions coherent across environments and workflows. |
| Recommendation — Apply PR.AA-05 to keep entitlements and authorisations consistent across cloud, code, and infrastructure. | ||
Key terms
- Continuous Identity: A governance model that turns identity data into live access decisions. Instead of relying on static approvals and periodic reviews, continuous identity reevaluates whether access should still exist based on current context such as risk, device state, ticket status, or business need.
- Ephemeral Credentials: Ephemeral credentials are short-lived access artefacts issued for a limited task or session. They reduce the window for abuse, but they only improve security when paired with strong scope limits, telemetry, and automatic revocation at task completion.
- Policy as Code: Policy as code stores authorization logic in version control and evaluates it through testable, reviewable rules. For agent governance, it makes runtime decisions reproducible and measurable, which is critical when actions can be triggered by untrusted content and executed at machine speed.
- Hybrid Access Control: A combined approach where RBAC sets the broad entitlement boundary and ABAC narrows access based on context. In practice, this is often the most workable pattern for dynamic enterprises because it preserves auditability while still supporting time-, device-, location-, or purpose-aware decisions.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 27, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org