Zero standing privileges is the new baseline for privileged access

At a glance

What this is: Zero standing privileges removes persistent privileged access and replaces it with time-bound entitlement, because always-on permissions and admin protocols are the main paths attackers use for lateral movement.

Why it matters: IAM, PAM and NHI teams need to treat standing privilege as an exposure window across human admins, service accounts and AI agents, not just as an entitlement design issue.

By the numbers:

• Privileged ports are used somewhere inside the average enterprise every 10 minutes.
• More than 70% of threat activity flows through just four admin protocols.

Context

Zero standing privileges is a governance model that removes always-on privileged access and replaces it with time-bound access granted only when it is needed. In practice, that means the control problem is not just who has access, but how long that access exists and whether it can be scoped tightly enough to limit misuse.

This matters because standing privilege turns routine administrative pathways into durable attack paths. When identities retain excess rights across users, service accounts, and machine-driven workflows, attackers do not need to create access from scratch; they inherit it through compromise, reuse, or lateral movement.

The article frames ZSP as a response to persistent privilege sprawl in enterprise networks. That is a typical starting position for modern IAM and PAM programmes, especially where privileged access has accumulated faster than governance has been able to remove it.

Key questions

Q: What breaks when standing privileged access is still the default?

A: Standing privilege breaks least-privilege governance because access remains available long after the specific task has ended. That widens the attack surface, increases the impact of credential compromise, and makes it harder to prove that elevated rights were justified. Temporary elevation only reduces risk when the default state is non-privileged.

Q: Why do Windows networks with standing privilege increase lateral movement risk?

A: Windows networks with standing privilege increase lateral movement risk because an attacker who steals one hash can often reuse it across multiple systems. Flat networks, reused credentials, and excessive local admin rights make that reuse more valuable. Once inside, the attacker can hop from host to host, seeking higher privilege and persistence without needing the original password.

Q: How should security teams phase out always-on privilege without breaking operations?

A: Start with the identities and pathways that create the largest exposure, then move to time-bound access for approved tasks. The goal is not to remove all privilege at once, but to replace permanent access with bounded entitlement where it matters most. Legacy systems may need exception handling, but the default should shift to expiry-based control.

Q: What should teams do when a service account has suspicious activity and over-privileged access?

A: Treat the event as a high-priority incident, validate the account's approved use, and assess what production systems or sensitive data it can reach before deciding on containment. A service account with stale credentials and broad access should never be handled as a routine anomaly.

Technical breakdown

How zero standing privileges changes privileged access control

Zero standing privileges is not just stricter least privilege. It adds a time boundary to access so that a privileged entitlement exists only for the approved task window, then disappears. That changes the control plane from static assignment to dynamic issuance and revocation. In operational terms, the identity is not trusted because it holds a role permanently; it is trusted only after verification, contextual approval, and scoped provisioning. This model is especially relevant where admin work is intermittent and high risk, because the shortest practical access window reduces the chance that unused rights become an attacker’s foothold.

Practical implication: move privileged access decisions from permanent assignment into time-scoped issuance and revocation workflows.

Why standing privilege becomes a lateral movement path

Standing privilege increases blast radius because stolen credentials inherit whatever rights were already present. Once an attacker lands in an environment, broad always-on permissions let them move from the initial account to admin protocols, adjacent systems, and sensitive services without having to escalate through a separate exploit. The article highlights RDP, SMB, WinRM, SSH, and RPC as the main highways for this activity. In identity terms, the failure is not only authentication weakness but persistence of privilege across sessions, which creates a reusable path for abuse long after the original account should have been constrained.

Practical implication: identify privileged protocols and remove always-on access before adversaries can reuse stolen credentials across them.

How NHI sprawl and AI agents extend the ZSP problem

Zero standing privileges must now account for service accounts, machine identities, and AI agents, not just human administrators. These identities often operate continuously, hold permissions that outlive the task they were created for, and are difficult to review through human-centric access models. That makes them a natural source of privilege creep if the programme only governs user accounts. The technical issue is lifecycle mismatch: access is granted for infrastructure convenience, but the entitlement is never re-evaluated against actual use. In ZSP terms, that leaves a long-lived access surface where machine and agent permissions remain available even when they are no longer operationally justified.

Practical implication: inventory non-human identities alongside users and enforce the same privilege-expiry logic across all of them.

Threat narrative

Attacker objective: The attacker aims to convert one compromised identity into broad internal reach by exploiting persistent privileged access and the admin protocols that carry it.

1. Entry occurs through an identity that already has broad standing permissions, so compromise immediately yields usable access instead of forcing a separate privilege-escalation exploit.
2. Credential abuse and protocol reuse let the attacker operate through admin pathways such as RDP, SMB, WinRM, SSH, or RPC, which blend into normal enterprise traffic.
3. Escalation follows naturally because the compromised identity inherits persistent rights that were never time-scoped, allowing movement across adjacent systems and services.
4. Impact is reached when the attacker uses those always-on privileges to extend access laterally and broaden control across the environment.

Breaches seen in the wild

• Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Standing privilege is now a blast-radius problem, not just an entitlement problem. The article makes clear that excessive access is the norm, which means the real security question is how far one compromised identity can travel before it is stopped. When privileges remain always-on, the access model itself expands the attacker’s operating radius. Practitioners should treat privilege duration as a core part of blast-radius reduction.

Zero standing privileges is the practical expression of time-bound trust. ZSP does not replace least privilege, it makes it enforceable in operations by adding an expiry condition to access. That matters because access that is technically minimal but permanently available still creates exposure. The implication for identity programmes is that entitlement design and entitlement duration must be governed together.

Service accounts and AI agents make privilege governance inseparable from NHI lifecycle control. The article’s inclusion of non-human identities shows that ZSP is no longer a human-admin-only control pattern. When machine identities carry standing rights, privilege sprawl becomes a lifecycle issue, not a permissions issue alone. Practitioners should govern issuance, scope, and expiry across every non-human identity class.

Privileged protocol exposure is the named concept teams should be tracking. RDP, SMB, WinRM, SSH, and RPC are not just transport details; they are privileged pathways that become high-value attack corridors when access is always-on. The control lesson is that protocol-level governance matters as much as role design. Teams should map which privileged pathways remain open by default and close them as part of identity policy.

ZSP validates the convergence of PAM and NHI governance. The model only works when human admins, service accounts, and automated actors are governed through the same privilege lifecycle discipline. That convergence is where many programmes are still immature. The practitioner implication is to stop treating machine and human privilege as separate operational silos.

From our research library:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
• Read next: Just-in-Time Access and Zero Standing Privilege Guide

What this signals

Privilege expiry will become the control teams are judged on. Access reviews alone cannot keep up when human admins, service accounts, and AI agents accumulate rights faster than they are removed. The programme signal to watch is whether access can be issued and revoked as part of the same operational flow, rather than as a periodic cleanup exercise.

Standing privilege and non-human identity governance are converging. As machine identities outnumber human identities and privileged protocols remain active inside normal networks, the boundary between PAM and NHI management keeps narrowing. Teams that still govern them separately will struggle to explain why dormant access remains available after its business purpose has ended.

Privileged protocol control is becoming a ZTA test case. Zero Trust Architecture depends on continuous verification, but always-on privileged channels undermine that logic if they remain open by default. The practical signal is whether policy is enforced at the protocol layer, not just at account creation.

For practitioners

• Inventory every privileged identity Map human admins, service accounts, machine identities, and AI agents to determine where standing privilege still exists and which accounts can reach critical systems by default.
• Convert permanent privilege into time-bound issuance Replace always-on elevation with just-in-time access for administrative tasks, interactive sessions, and sensitive protocol use, then revoke access automatically when the task ends.
• Restrict privileged protocols by identity and context Apply context-aware controls to RDP, SMB, WinRM, SSH, and RPC so that only in-scope identities can use them and only for approved activities.
• Audit non-human identities for privilege creep Review service accounts and workload identities for permissions that exceed their current function, then remove access that persists after the operational need has changed.

Key takeaways

• Zero standing privileges is best understood as time-bound privilege governance, not merely a stricter version of least privilege.
• The biggest exposure comes from always-on rights on privileged pathways, where a single compromise can quickly expand into lateral movement.
• Programmes that include service accounts and AI agents in the same expiry logic as human admins are closer to real control than those that only review user roles.

Key terms

• Zero Standing Privileges (ZSP): A security posture where no identity, human or non-human, holds persistent access rights. Access is provisioned dynamically on demand and automatically revoked after use. ZSP is the gold standard for NHI access control.
• Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Privileged Protocol: A privileged protocol is a remote management or administrative channel that can perform powerful actions once authenticated. In this article's context, the concern is not the protocol itself, but the fact that broad trust in the channel can turn valid credentials into escalation routes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.