TL;DR: Two different access patterns are illustrated by Tailscale and StrongDM: one secures network connectivity with WireGuard and identity integration, while the other centralises access to databases, servers, and Kubernetes with hidden credentials, audit logging, and JIT access, according to StrongDM. The deeper issue is that VPN-style access can secure transport without solving privilege sprawl, session visibility, or offboarding across non-human access paths.
At a glance
What this is: This article compares Tailscale with other access approaches and finds that VPN-first networking secures connectivity better than it secures privileged access governance.
Why it matters: IAM, PAM, and NHI teams should read this as a reminder that access transport, credential custody, and session control are separate governance problems.
Context
VPN-first access controls the network path first and leaves privilege governance as a secondary concern. That model can work for secure connectivity, but it becomes strained when the requirement is to centralise and monitor access to databases, servers, and Kubernetes resources.
For identity programmes, the distinction matters because the governance problem is not only who can connect. It is also which credentials are exposed, how access is revoked, whether sessions are observable, and whether third-party or ephemeral access can be offboarded cleanly.
Key questions
Q: How should teams handle privileged access when VPNs are already in place?
A: Treat the VPN as a network transport layer, not as a privileged access control. Teams still need brokerage for credentials, resource-scoped authorisation, and session logging if they want to govern what users can do after they connect. Otherwise, the VPN improves reachability while leaving privilege sprawl untouched.
Q: Why do hidden credentials matter for databases, servers, and Kubernetes?
A: Hidden credentials matter because reusable secrets expand the blast radius of each login. If users can see or reuse passwords, SSH keys, or tokens, the organisation loses control over where privilege exists and how long it lasts. Hiding those credentials inside a control plane keeps access governable at session level instead of endpoint level.
Q: What are the signs that remote access controls are too broad for sensitive internal systems?
A: Remote access is too broad when users can reach more systems, files, or functions than their job requires, especially if clipboard, file transfer, or unrestricted shell access is left open by default. Another warning sign is access that stays active after role changes. If sessions are not restricted, recorded, or tied to specific targets, the control boundary is already too loose.
Q: What is the difference between privileged identity management and privileged access management?
A: Privileged identity management focuses on controlling privileged identities, roles, and elevation of access, while privileged access management focuses on securing and governing access to sensitive resources. In practice, the two overlap and are often used together. PIM is stronger on identity lifecycle and temporary privilege, while PAM is broader across privileged session control and access enforcement.
Technical breakdown
Why WireGuard-based access is not the same as privileged access governance
Tailscale uses WireGuard to create encrypted network tunnels and ties network membership to identity provider controls such as MFA and user offboarding. That gives teams strong transport security and a useful control plane for connectivity. But a network tunnel does not itself manage database credentials, SSH keys, Kubernetes access, or session-level commands. In other words, the control surface is the path into the environment, not the privileged actions performed inside it.
Practical implication: separate network access design from privileged access governance instead of treating them as the same control.
Why hidden credentials change the governance model for NHIs and admins
The article contrasts VPN-style access with systems that keep underlying credentials hidden from end users. That matters because visible or user-held credentials increase the number of places secrets can be copied, reused, or left behind during offboarding. When the access layer brokers the connection and removes direct exposure to secrets, privilege becomes easier to scope to the resource and session rather than the user’s local environment. This is an NHI and PAM issue because credential custody determines blast radius.
Practical implication: reduce direct credential exposure where administrators, vendors, or service operators do not need to see the secret itself.
How auditability differs between connectivity and command-level access
Tailscale’s model is oriented around secure network access, while the alternative patterns in the article emphasize recording queries, SSH sessions, RDP sessions, and kubectl activity. That distinction matters because audit-compliant logging at the network layer does not necessarily tell you what happened after the connection was established. For privileged access governance, the key question is whether the control records the action path, not just the login path.
Practical implication: verify that logs capture the session and command layer, not only authentication events.
Threat narrative
Attacker objective: The objective is to reach protected infrastructure or data paths through legitimate access that is broader or less observable than the organisation intended.
- Entry occurs through legitimate remote access into the network or resource boundary, typically with identity-provider-backed authentication and encrypted tunneling.
- Credential exposure or privilege sprawl emerges when access depends on distributed database credentials, SSH keys, or broad VPN reach instead of brokered least-privilege access.
- Impact appears when administrators, vendors, or engineers can reach more systems than intended and the organisation lacks complete session-level visibility or clean offboarding controls.
Breaches seen in the wild
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
VPN-first access is a transport control, not a full privilege model. Tunnels can authenticate users and encrypt traffic, but they do not automatically govern what happens after the connection is established. That leaves teams with a familiar blind spot: network access looks controlled while privileged actions remain under-governed. The practitioner conclusion is to stop treating remote access and privileged access as interchangeable controls.
Hidden credential custody is the real differentiator in access design. When end users never see the underlying database credential, SSH key, or Kubernetes secret, the governance model shifts from distribution to brokerage. That reduces credential sprawl, narrows offboarding exposure, and makes resource-level control more enforceable. The practitioner conclusion is that access architecture should be judged by who can hold the secret, not just who can reach the network.
Session-level observability is now a baseline requirement for modern access governance. Logging that stops at authentication cannot answer the questions auditors and responders care about: what command ran, what query executed, what resource changed, and whether a third party exceeded scope. The practitioner conclusion is that auditability must extend beyond login telemetry into the session and action layer.
Ephemeral access only works when it is attached to resource scope, not just identity scope. Just-in-time access and expiring credentials are useful only if they constrain the specific database, server, or cluster action being requested. Otherwise, the organisation replaces standing privilege with standing reach. The practitioner conclusion is to evaluate access patterns by scope, session, and revocation path rather than by authentication method alone.
Privilege blast radius is the concept this debate keeps exposing. VPN-first architectures can make connectivity simpler, but they often leave the maximum reachable surface too broad for modern PAM expectations. The practitioner conclusion is to measure access by blast radius, because that is the governance unit that determines how far a compromised identity can travel.
What this signals
Privilege blast radius is the right lens for access modernisation. Teams that focus only on VPN replacement risk preserving the same underlying entitlement sprawl behind a newer transport layer. The more useful question is whether a given access path limits the reachable resources, session scope, and revocation burden.
Identity integration is necessary but not sufficient for modern access governance. Once access is being used to reach databases, servers, or Kubernetes, the programme has to account for credential custody, session evidence, and third-party expiry as first-class controls.
For practitioners
- Define remote access and privileged access separately Map which use cases only need secure connectivity and which require database, server, or Kubernetes command governance. Do not let VPN coverage become the default answer for privileged workflows.
- Broker credentials instead of distributing them Remove direct end-user possession of database passwords, SSH keys, and similar secrets wherever the workflow permits. Broker access through the control plane so revocation affects the underlying resource path.
- Require session and command visibility Check that access logging captures queries, shell activity, and kubectl operations, not only login events. If the audit trail stops at authentication, you do not have complete privileged access observability.
- Tighten third-party access to project scope Limit vendor and contractor access to explicit resources with automatic expiry and a revocation path tied to project closure. Offboarding should remove access at the access broker, not rely on manual cleanup across systems.
- Review cloud PAM coverage against blast radius Compare current access paths with the actual systems users can reach after authentication. If one identity can move from connectivity to broad administrative reach, reduce the reachable surface before expanding use cases.
Key takeaways
- VPN-first access can secure connectivity without solving the governance problem of who can exercise privileged actions inside the environment.
- The article’s core tension is between encrypted network reachability and controlled access to databases, servers, and Kubernetes.
- Practitioners should judge access models by credential exposure, session visibility, and revocation scope rather than by authentication alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article contrasts hidden credentials with exposed access paths that spread secrets. |
| NHI-05 — Overprivileged NHI | The article’s central issue is broad access reach that exceeds least-privilege needs. | |
| Recommendation — Reduce secret exposure by brokering access instead of distributing credentials directly. Scope access paths so users and vendors can only reach the resources they actually need. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential custody and rotation are central to the access model comparison. |
| Recommendation — Apply IA-5 to govern credential issuance, rotation, and revocation for remote access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post is fundamentally about entitlement scope and authorization boundaries. |
| Recommendation — Review entitlements to ensure remote access does not exceed the intended authorization boundary. | ||
| MITRE ATT&CK | TA0008 — Lateral Movement | Broad remote access can enable movement across connected infrastructure once authenticated. |
| Recommendation — Map remote-access pathways to TA0008 and reduce the systems reachable from any single session. | ||
Key terms
- Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
- Credential Broker: A credential broker is a control layer that releases credentials, tokens, or federated access only after verifying the requester and the request context. It reduces secret copying by shifting access from static distribution to point-of-use delivery, which improves auditability and narrows exposure windows.
- Session Visibility: Session visibility is the ability to see what an identity actually did during an access session, not just that access occurred. It usually includes commands, queries, timestamps, and resource changes, which makes it vital for forensics, scoping, and accountability after a breach.
- Privilege Blast Radius: The amount of damage an attacker can do after compromising a privileged identity. It is a more useful operational measure than simple account counts because it reflects how far access can spread across cloud, SaaS, and machine identities once a control path is abused.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 7, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org