TL;DR: Secrets remain a major attack surface because they are often unmanaged, static, and invisible across code, vaults, and cloud workflows, according to SSH Communications Security's analysis of KuppingerCole's Compass coverage. Ephemeral provisioning helps reduce exposure, but access review models still assume credentials persist long enough to be observed and revoked.
At a glance
What this is: This analysis argues that static secrets and standing credentials remain a core identity control problem, while JIT issuance changes how human and machine access is governed.
Why it matters: IAM teams need to rethink how they govern access when credentials are short-lived, distributed across hybrid environments, and tied to both human and machine workflows.
Context
Secrets management is the discipline of controlling credentials such as API keys, certificates, passwords, tokens and private keys across their full lifecycle. In hybrid and cloud-heavy environments, the control problem is not just storage. It is visibility, rotation, scope and revocation across systems that were never designed to keep secrets short-lived.
The article's core governance point is that standing credentials create unnecessary exposure because they remain valid long enough to be stolen, reused or over-permissioned. JIT issuance changes the pattern by making access session-scoped, but that also shifts control expectations from periodic review to issuance-time governance.
For IAM and PAM teams, the practical question is how to treat human and machine access consistently when both depend on secrets that may be embedded in pipelines, workloads and remote access flows. The article positions JIT secrets as an operational response to that combined risk rather than as a narrow vaulting feature.
Key questions
Q: What fails when teams keep relying on standing secrets?
A: Standing secrets fail because they create reusable access that can be copied, shared, or abused long after the original task. That breaks the basic assumption that access can be tightly bounded by session or purpose. The result is broader exposure, weaker traceability, and more paths for lateral movement if the secret leaks.
Q: When should organisations prioritise JIT access over persistent credentials?
A: Organisations should prioritise JIT access when the credential is only needed for a discrete task, session, or approval-bound workflow. If the access does not need to exist continuously, persistence adds risk without adding useful capability. JIT is most valuable where human admin access and machine workflows both create standing-credential exposure.
Q: How do identity teams know whether secrets governance is actually working?
A: Identity teams know secrets governance is working when they can prove that every active secret has an owner, an approved scope, and a tested revocation path. If they cannot quickly identify where a secret is used or remove it without breaking the workload, governance is still incomplete.
Q: What is the difference between secrets management and CIEM?
A: Secrets management governs the credential itself, including how it is created, stored, rotated, and revoked. CIEM governs the cloud permissions that credential can exercise once it is used. They are different controls, but they need to work together because a short-lived secret can still unlock excessive cloud access.
Technical breakdown
Why static secrets create identity risk
Static secrets are credentials that remain valid until someone rotates or revokes them. In practice, they end up stored in code, scripts, vaults, hard drives, and unsecured configuration paths, which makes discovery and containment difficult. Once exposed, a secret can be reused without the visibility signals that human authentication systems normally generate. That is why secret sprawl becomes an identity control problem, not just a storage problem. The more places a secret exists, the harder it is to prove who has it, where it is used, and whether it still matches the intended access scope.
Practical implication: inventory every credential location and treat hidden secret copies as active access paths, not harmless duplicates.
How JIT secret provisioning changes access control
Just-in-time secret provisioning replaces permanent credentials with ephemeral credentials that expire automatically after a task or session. This changes the control model because issuance becomes the governing event, not later review. The credential is valid only for the intended scope, which narrows the blast radius if it is intercepted. It also improves traceability because access is tied to a specific request and purpose. For machine workloads, this matters as much as for administrators, because service-to-service access often has the same standing-credential weaknesses as human remote access.
Practical implication: move approval, scope, and expiry decisions to issuance time so credentials never exist longer than the task requires.
Why CIEM matters when secrets span cloud and workloads
Secrets governance weakens when cloud permissions and secret issuance are managed separately. CIEM adds visibility into which identities, applications, and services can reach which resources, which matters when a secret alone is not the full control story. If an account is over-permissioned, even a short-lived credential can be abused within its valid window. That is why entitlement context has to sit beside secret lifecycle controls. Least privilege is not only about the secret itself, but about the resource paths that secret can unlock across cloud environments.
Practical implication: pair secret governance with entitlement review so short-lived credentials cannot inherit broader cloud access than intended.
Threat narrative
Attacker objective: The attacker wants to turn one exposed secret into durable, low-noise access to protected systems and data.
- Entry begins when a secret is exposed in code, a vault, or another unmanaged location that an attacker can discover without interacting with the victim directly.
- Credential access follows when the leaked secret is copied, reused, or harvested for later use against cloud, workload, or administrative services.
- Escalation occurs when the same credential unlocks broader permissions than intended, allowing lateral movement or privilege abuse across connected systems.
- Impact is realised when the attacker uses the valid secret to reach sensitive systems or extract data while appearing as a legitimate identity.
Breaches seen in the wild
- Cisco DevHub breach 2024: A misconfigured script left non-public files on Cisco's DevHub; IntelBroker took them and claimed reuse of hard-coded SSH credentials.
- BitMart hot wallet hack 2021: A stolen private key let an attacker drain two BitMart hot wallets on Ethereum and Binance Smart Chain of about $150 million in December 2021.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Secret visibility is now an identity control, not a storage concern. The article reflects a wider shift in which unmanaged credentials are treated as active access pathways rather than passive configuration artefacts. That matters because secrets hidden in code, pipelines, or vault sprawl can be used without the normal human-authentication signals teams rely on. Practitioners should therefore govern discovery, rotation, and revocation as identity functions, not as vault administration.
JIT access exposes the limits of standing-credential governance. The core advantage is not merely shorter lifetime, but the fact that access is granted only when a task exists. That changes the trust model for both human operators and machine workflows, because standing access assumes a future need that may never materialise. The implication is that access design must move from persistent entitlement to purpose-bound issuance.
Ephemeral credential trust debt: organisations inherit governance debt whenever they rely on short-lived credentials but keep review processes built for persistent accounts. Access review, recertification, and offboarding all assume there is a stable artefact to inspect. When credentials are issued and discarded within a task window, the control point shifts to policy, scope, and issuance timing. Practitioners need to treat that shift as a governance redesign issue, not a tuning exercise.
Human and machine identities now fail through the same secret pathways. The article is useful because it does not separate administrator access from workload access. Both rely on credentials that can be static, overexposed, and difficult to govern at scale. This is where IAM, PAM, and NHI programmes converge. The practical conclusion is that control ownership should follow credential behaviour, not identity type alone.
Zero Trust for secrets only works when entitlement context is attached. Eliminating standing credentials reduces exposure, but it does not eliminate the risk created by over-permissioned access. If cloud entitlements remain broad, the secret lifetime becomes less important than the resource scope it unlocks. Practitioners should treat secret governance and CIEM as one control plane rather than adjacent tools.
From our research library:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
- Read next: Guide to NHI Rotation Challenges
What this signals
Ephemeral credential trust debt: security teams often modernise secret delivery faster than they modernise governance. When issuance becomes dynamic but review, revocation, and offboarding still assume persistent access, the programme gains speed without gaining control. That gap is now one of the clearest weak points in IAM and PAM design.
IAM leaders should treat secret sprawl and entitlement sprawl as the same operational problem. A credential that expires quickly still creates risk if the identity behind it can reach too much, so the control model has to join secret lifecycle with cloud authorisation and workload context.
The strongest programmes will stop thinking in terms of vaults alone and start thinking in terms of access duration, access scope, and access disposal. That is the practical shift hidden inside JIT access: the control boundary moves from storage to issuance and from review to policy enforcement.
For practitioners
- Inventory every secret path Map where passwords, API keys, certificates, tokens and SSH keys exist in code, pipelines, vaults and cloud workflows, then classify which are standing credentials and which are already ephemeral.
- Shift approval to issuance time Require task-specific policy checks before credentials are issued, so expiry, scope and identity context are enforced before the secret exists.
- Pair secret governance with entitlement review Review who or what can use each credential after issuance, especially in cloud and CI/CD environments where a valid secret can still unlock excessive resource access.
- Retire standing credentials where JIT is viable Replace always-on passwords, keys and tokens with ephemeral access for admin, service and workload use cases that do not truly need persistence.
- Align offboarding with secret revocation Treat removal of human, service and vendor access as a secret-lifecycle event, not just an account event, so access cannot outlive the relationship or workflow.
Key takeaways
- Static secrets remain a governance problem because they can be copied, reused, and abused long after they were issued.
- The article's central evidence is that leaked secrets can take 27 days to remediate, which is far too long for reusable credentials.
- The practical response is to combine JIT issuance with entitlement controls so access is short-lived and narrowly scoped.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Standing credentials and delayed revocation are central to the article's access lifecycle risk. |
| NHI-05 — Overprivileged NHI | The article warns that short-lived credentials still fail when cloud permissions are too broad. | |
| NHI-07 — Long-Lived Secrets | The article directly contrasts standing credentials with ephemeral provisioning. | |
| Recommendation — Track secret retirement to offboarding events so access never outlives the task or relationship. Reduce the permission scope behind each secret so JIT access cannot inherit excessive entitlement. Replace long-lived credentials with short-lived issuance wherever continuous access is not required. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle control is directly implicated by rotation, revocation, and secret issuance. |
| Recommendation — Apply authenticator management to govern issuance, rotation, and revocation of all secrets. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes how exposed secrets enable reuse, privilege abuse, and movement across systems. |
| Recommendation — Map leaked secrets to credential-access and lateral-movement detections in your threat model. | ||
Key terms
- Secrets Management: The discipline of securely storing, distributing, rotating, and auditing secrets across an organisation's systems and pipelines, typically implemented via a centralised secrets vault such as HashiCorp Vault, AWS Secrets Manager, or Akeyless.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
- Standing Credential: A standing credential is any secret that remains usable until it is manually rotated or revoked. In NHI governance, it creates durable access that can be stolen, replayed, or propagated from trusted tooling unless runtime boundaries and expiry are built in.
- Cloud Infrastructure Entitlement Management: Cloud Infrastructure Entitlement Management focuses on who has access to what in cloud systems, especially excessive or unused permissions. It helps reveal overprivileged identities, but it does not automatically remove them. In practice, it is most useful when tied to policy enforcement and access expiry mechanisms.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org