Vaults do not deliver zero standing privilege in modern enterprises

At a glance

What this is: This article argues that vaults do not achieve zero standing privilege because they protect only onboarded credentials, while many privileged identities and accounts still retain persistent access outside the vault model.

Why it matters: IAM, PAM, and NHI teams need to treat vaulting as a partial control, because standing privilege remains the attack path unless discovery, context, and ephemeral issuance are governed end to end.

By the numbers:

• 86% of breaches involve compromised credentials.

👉 Read Venice.io's analysis of why vaults do not deliver zero standing privilege

Context

Zero standing privilege breaks down when an organisation treats a vault as proof that privilege no longer exists. The real governance gap is that many privileged identities keep their permissions even when a secret is placed under vault control, so access can remain standing outside the checkout workflow.

In modern enterprises, privileged access spans cloud, SaaS, on-prem, machine identities, and AI-driven accounts. A vault only governs what has been manually onboarded, which means the remaining estate can stay unmonitored and permanently privileged even when the organisation believes it has modernised access control.

The article’s core point is that the old model assumed a small, stable set of admins and servers. That assumption no longer matches the scale or shape of privileged access, especially where legacy applications block automatic rotation and JIT wrappers only time-limit access rather than remove underlying privilege.

Key questions

Q: What breaks when credential vaulting is used as a substitute for zero standing privilege?

A: Vaulting can protect a secret while it is stored, but it does not remove the secret or the privilege behind it. That means the access model still depends on persistent credentials, checkout workflows, and rotation discipline. The practical failure is that teams confuse managed persistence with ephemerality, so standing access survives even when the vault is well controlled.

Q: Why do vaults and JIT wrappers still leave standing access in place?

A: Because they often change the timing of access without changing the account’s baseline permissions. If an account remains entitled after the session ends, the privilege is still standing. The risk is highest when teams treat time limits as equivalent to revocation, which they are not.

Q: How do security teams know whether PAM is actually reducing privilege risk?

A: Measure how much privileged access is permanent, how often elevation is task-scoped, and whether session activity matches the approved purpose. If privileged sessions still last far beyond the task or if approvals are routinely broad, PAM is reducing friction more than risk.

Q: What should organisations do first when legacy applications cannot support automatic rotation?

A: Treat those applications as governance exceptions and identify the privileged accounts they force to remain static. Then add compensating oversight for the residual access, because rotating the credential is not enough when the application itself preserves standing privilege.

Technical breakdown

Why vault checkout does not remove standing privilege

A vault changes how a secret is retrieved, not whether the underlying account still has broad permissions. If a service account, cloud role, or admin identity remains entitled to perform privileged actions, then checkout is only an extra step before the same access is exercised. In practical terms, vaulting can hide exposure without changing the authorization model that creates the risk. That is why organisations can appear to have stronger control while still leaving the privilege itself intact. The control boundary is the credential store, not the entitlement layer.

Practical implication: review whether vaulting is reducing exposure or just adding process around accounts that still hold standing permissions.

Why just-in-time access fails when it is layered onto permanent privilege

Just-in-time access works only when the privilege itself is issued ephemerally, not when a timer is wrapped around an already-privileged account. In that common pattern, access disappears when the session ends, but the account still retains its original rights and can be reused later. That creates a false sense of zero standing privilege because the organisation has time-bound usage, not time-bound entitlement. The difference matters most where approval workflows and vault checkouts are treated as substitutes for real privilege issuance and revocation.

Practical implication: treat JIT as an issuance model, not a scheduling layer on top of standing accounts.

Why continuous discovery is the missing control plane for zero standing privilege

Vaults cannot secure what they do not know about, and that becomes the decisive weakness in large hybrid environments. Continuous discovery is the only way to find the long tail of privileged identities that were never onboarded, were onboarded once and forgotten, or cannot be rotated by the application. Without that visibility, contextual policy cannot be applied and ephemeral privileges cannot be enforced consistently. The result is a split estate: controlled secrets in one place and unmanaged standing access everywhere else.

Practical implication: build discovery for cloud, SaaS, on-prem, and machine identities before assuming your PAM stack covers the full estate.

Threat narrative

Attacker objective: The attacker’s objective is to reuse standing privilege to move through enterprise systems without needing to defeat the vault itself.

1. Entry occurs through compromised credentials that remain valid because the underlying privilege persists even when the secret is vaulted.
2. Escalation follows when attackers use long-lived service accounts, cloud roles, or admin identities that were never converted to ephemeral privilege.
3. Impact comes from broad access exposure across enterprise systems, which enlarges the attack surface and preserves attacker opportunity well after a vault checkout ends.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vaulting credentials is not the same as eliminating privilege: The control only governs checkout and storage, while the authorization layer beneath it can remain fully intact. That distinction is why organisations can look disciplined on paper and still retain a wide standing-privilege footprint in practice. The implication is that PAM programmes must be evaluated on privilege state, not vault presence.

Zero standing privilege is a privilege-issuance problem, not a storage problem: The industry keeps overloading vaults with expectations they were never designed to meet. When access remains attached to durable identities, time-limiting the session does not change the standing nature of the privilege. Practitioners need to separate secret handling from entitlement lifecycle management.

Continuous discovery is the governance control that legacy vaulting lacks: You cannot govern what you cannot enumerate, and modern estates contain too many cloud, SaaS, machine, and AI-driven accounts for manual onboarding to be sufficient. This creates a hidden privilege layer outside the vault model. Practitioners should assume their unmanaged privileged estate is the default gap until proven otherwise.

Ephemeral privilege issuance is the named concept that matters here: Standing access should be treated as standing risk, because any model that leaves the entitlement behind has not reached zero standing privilege. Vault workflows, rotation cadence, and approval gates are secondary if the underlying privilege survives between tasks. The operational takeaway is to judge access by when privilege exists, not by when a secret is checked out.

Legacy PAM architecture now creates a false boundary between control and exposure: The article reflects a broader market shift away from reactive control layers and toward real-time access governance. That shift is not cosmetic; it changes whether identity security is measuring secrets or governing privilege itself. Practitioners should re-centre PAM around entitlement reduction and dynamic issuance.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Ephemeral privilege issuance is the control shift this article points toward: access must exist only for the duration of the task, not merely for the duration of a vault checkout. That matters because access review cadences cannot eliminate privilege that never left the account in the first place.

The programme-level implication is that PAM, IGA, and cloud governance can no longer be run as separate conversations. If discovery does not cover cloud roles, service accounts, and AI-driven accounts together, standing privilege will keep reappearing in the blind spots between tools.

For practitioners

• Map standing privilege outside the vault Inventory cloud, SaaS, on-prem, machine, and AI-driven accounts that still retain elevated rights even when secrets are vaulted. Separate stored secrets from the actual entitlement state so you can see where privilege persists beyond checkout.
• Rebuild JIT as ephemeral privilege issuance Replace timer-based wrappers around permanent accounts with access that is created for the task and revoked when the task completes. Use task scope and risk context to decide whether the entitlement should exist at all.
• Prioritise non-rotatable legacy accounts Identify applications that block automatic rotation and treat them as high-risk exceptions, because static credentials in those systems remain vaulted on paper but permanent in practice. Apply compensating controls until the application can support true lifecycle governance.
• Deploy continuous discovery across the full estate Continuously enumerate privileged identities that were never onboarded or were onboarded once and forgotten. Discovery has to cover cloud, SaaS, on-prem, and machine identities if you want to close the unmanaged privilege gap.

Key takeaways

• Vaults can reduce secret handling risk without removing the privileges attached to the account behind the secret.
• The article’s scale signal is blunt: most enterprise privilege still sits outside a manually onboarded vault model, and 86% of breaches involve compromised credentials.
• The practical answer is to govern entitlement creation and removal continuously, because zero standing privilege depends on ephemeral issuance and full discovery, not checkout workflows.

Key terms

• Zero Standing Privilege: A control model in which an identity does not keep persistent access unless it is actively needed. For NHIs, this means credentials and permissions are issued for a narrow task and then removed. It reduces the time window and reuse value of stolen access.
• Ephemeral Privilege: Ephemeral privilege is access that exists only for a short task or runtime window, then should disappear. In cloud and container environments, the challenge is not granting it, but proving it was created, used, and removed within the intended boundary before it becomes a lingering exposure.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Continuous discovery: Continuous discovery is the ongoing process of detecting identities as they appear, change, or disappear across environments. For AI agents and other NHIs, it prevents inventory drift and keeps ownership, privilege, and lifecycle controls aligned with the live environment.

What's in the full article

Venice.io's full blog post covers the operational detail this post intentionally leaves for the source:

• The article’s argument for why vault-based PAM cannot discover unmanaged privileged identities across cloud, SaaS, on-prem, and AI-driven accounts.
• The description of how legacy applications prevent automatic rotation and force static credentials to remain in practice even when they are vaulted.
• The operational case for contextual access decisions and ephemeral privilege issuance as the basis for zero standing privilege.
• The examples showing why time-bound access wrappers still leave the underlying privilege intact.

👉 The full Venice.io post expands on continuous discovery, contextual access, and ephemeral privilege issuance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.