TL;DR: Credential abuse starts about 22% of breach paths, ahead of vulnerability exploitation at 20%, because attackers often use access that already exists instead of breaking in, according to Apono. The governance gap is post-authentication control: access must be verified, time-bound, and auditable across people and non-human identities.
At a glance
What this is: This is an analysis of why zero trust fails when access is treated as a login event instead of a continuously governed entitlement.
Why it matters: IAM, PAM, and NHI programmes all need post-authentication controls because standing access, not login failure, is often the real exposure window.
By the numbers:
- Credential abuse starts about 22% of breach paths, ahead of vulnerability exploitation at 20%, because attackers often use access that already exists instead of breaking in.
Context
Zero trust only works when access is governed after authentication, not just at login. In this article, the core problem is standing access: permissions, tokens, and credentials that remain usable long after the original business need has passed.
For identity programmes, that changes the control objective from trust the session to verify every use of access. The relevant governance question is whether IAM, PAM, secrets management, and NHI controls can prove who or what is using access right now, for how long, and under which approval path.
Key questions
Q: What breaks when Zero Trust stops at authentication?
A: Zero Trust breaks when teams stop at authentication because proving identity does not automatically define what that identity may do. If authorization is still implicit inside applications, a compromised account can still move through systems with excessive privilege. The control gap is not login strength, but decision quality after login.
Q: Why do standing permissions increase breach risk even when MFA is in place?
A: MFA protects the login event, but it does not remove access that already exists after authentication. If permissions remain standing, an attacker who obtains a session, token, or approved account can move directly to privileged actions. Risk falls when access is short-lived, tightly scoped, and revoked automatically after the task ends.
Q: How do teams know if Zero Trust is actually improving access control?
A: Look for runtime evidence, not policy statements. If access decisions change based on device posture, session context, and resource sensitivity, the programme is moving in the right direction. If controls only show up in annual reviews or static diagrams, the architecture may be branded Zero Trust without behaving like it.
Q: How should security teams implement Zero Trust for non-human identities?
A: Start by inventorying every machine identity, assigning an owner, and mapping its access to a specific business function. Then apply least privilege, short-lived credentials, and revocation controls so each identity can be verified, limited, and retired on schedule. Zero Trust fails when machine access is treated as permanent infrastructure rather than governed identity.
Technical breakdown
Why post-login access is the real zero trust boundary
Zero trust is often reduced to MFA, SSO, or VPN replacement, but the enforcement boundary matters more than the sign-in event. If a user or workload authenticates once and then keeps broad access, the model is no longer zero trust in practice. The article correctly points to access after authentication as the control gap: access must be re-checked at the point of use, not simply at the point of entry. That is why policy, time limits, and auditability matter more than the login ceremony itself.
Practical implication: move enforcement to connection time and request time, not just identity proofing.
Standing permissions and long-lived credentials
Standing permissions create a persistence problem, not just a privilege problem. Once access is granted without an expiry condition, it can survive role changes, on-call transitions, and forgotten approvals. The same logic applies to long-lived tokens and credentials in secrets management: the risk is not only exposure, but durable usability after the original need has ended. In zero trust terms, the issue is that access becomes assumed by default and revoked only by exception.
Practical implication: replace indefinite entitlements with time-bound access and explicit revocation triggers.
Why zero trust must cover NHIs as well as people
The article is explicit that zero trust coverage has to include people and non-human identities such as service accounts, automation, and API keys. That matters because post-authentication trust does not become safer when the actor is non-human; it often becomes harder to see. A human engineer may request access in a workflow, but a service account can retain equivalent or greater reach without the same lifecycle oversight. The control problem is therefore not just authentication strength, but entitlement governance across actor types.
Practical implication: bring NHIs, service accounts, and machine credentials into the same access review and expiry model.
Threat narrative
Attacker objective: The objective is to turn legitimate but stale access into durable operational reach across systems and data.
- Entry occurs through valid access rather than initial compromise, because the attacker can use credentials, tokens, or permissions that were already in place.
- Escalation happens when standing permissions provide broader reach than the original task required, allowing privileged actions without a fresh approval event.
- Impact follows when the attacker abuses persistent access to reach systems, data, or administrative functions that the original login was never meant to protect.
Breaches seen in the wild
- Snowflake breach: Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.
- Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Post-authentication access is the real zero trust control plane: Zero trust fails when teams treat login as the security event and everything after it as trusted execution. That assumption breaks because most operational risk emerges from access that persists beyond the moment of authentication. The discipline has to shift to governing entitlement use, not just identity proofing.
Standing access is a lifecycle failure, not a policy typo: Permissions that remain available after the task ends show that joiner-mover-leaver controls are not reaching the point of use. This is where human IAM, PAM, and NHI governance converge: the same persistence problem appears whether the actor is an engineer, a service account, or an automation credential. Practitioners should treat persistence of access as a lifecycle defect.
Time-bounded entitlement is the decisive zero trust pattern: The article’s strongest claim is that access should exist only for the window it is needed and then disappear automatically. That is not a convenience feature; it is the mechanism that prevents yesterday’s approval from becoming today’s exposure. The implication for programmes is clear: if access cannot expire by design, zero trust is only partial.
Secret sprawl becomes zero trust debt when credentials outlive context: Long-lived tokens, keys, and passwords are not just secrets hygiene issues, they are standing-access mechanisms with a different wrapper. This is a named concept worth tracking because it links secret management directly to trust collapse after authentication. Practitioners should measure whether credential lifetime still exceeds business need, because that gap is the exposure window.
Auditability matters because zero trust must be provable after the fact: Time-limited access without searchable records still leaves teams unable to answer who accessed what, when, and why. The governance value of zero trust is not just denial of excess access, but evidencing the exact access path that was allowed. Security and compliance teams should treat audit completeness as part of the control, not a reporting afterthought.
From our research library:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Read next: Identity Security Posture Management (ISPM) Guide
What this signals
Standing access is the control gap zero trust still misses: If an entitlement survives beyond the task that justified it, the architecture is behaving like a traditional trust model with better login checks. Programmes need to measure whether access is truly ephemeral, because durable permissions create a second, quieter attack surface after authentication.
The strongest operational question is no longer whether users can sign in securely, but whether access can be proven, bounded, and removed in the same workflow. That requirement applies across IAM, PAM, and NHI governance, which is why access lifetime has become a board-level trust signal.
For practitioners
- Tighten post-authentication enforcement Move access checks to the moment of use, not only the moment of login. Verify identity, policy, and entitlement every time a sensitive resource is touched.
- Replace standing permissions with expiry Make privileged access time-bound by default so permissions disappear when the task ends. Use auto-expiry and explicit re-approval for recurring access.
- Bring NHIs into the same access model Include service accounts, automation, tokens, and keys in the same governance rules you apply to human access. Standing access is a risk regardless of actor type.
- Instrument access for auditability Log what was accessed, when it was accessed, and why it was approved so teams can reconstruct privileged activity without ticket archaeology.
- Review secrets that outlive their purpose Map where long-lived credentials still exist in production, then align credential lifetime to the shortest practical business need.
Key takeaways
- Zero trust fails when teams stop at authentication and leave access standing after login.
- The breach pattern most relevant here is not fresh compromise but abuse of already-granted access, including service accounts and other non-human identities.
- Programmes should shift control from sign-in to entitlement lifetime, with automatic expiry, auditability, and consistent governance across human and machine identities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Standing permissions and broad roles are the central failure mode discussed in the article. |
| NHI-07 — Long-Lived Secrets | The article links zero trust failure to credentials and tokens that remain usable after their original purpose ends. | |
| Recommendation — Reduce persistent entitlements and scope NHI access to the narrowest task window possible. Inventory long-lived credentials and replace them with time-bound access where feasible. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article repeatedly argues that access should be tightly scoped and not persist beyond need. |
| Recommendation — Apply least privilege to limit standing access and reduce post-authentication blast radius. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Zero trust here depends on continuously governing permissions and entitlements after sign-in. |
| Recommendation — Review entitlements continuously and revoke access that is no longer justified. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Credential abuse and reuse of existing access are the threat patterns underlying the article. |
| Recommendation — Map standing access to credential access and lateral movement risk in threat detection and response. | ||
Key terms
- Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.
- Post-Authentication Control Gap: The loss of visibility and enforcement quality after an identity has successfully signed in or obtained access. This gap is especially dangerous in hybrid and machine identity environments, because entitlement often persists even when the original business need has changed.
- Just-in-Time Access Request: Just-in-Time Access Request is a pattern that grants access only when it is needed and only for the duration required. It reduces standing privilege by making access temporary, policy driven, and task scoped. This approach is especially useful for contractors, sensitive systems, and short-lived operational work.
- Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 27, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org