Zero trust solutions are failing where access persists after login

At a glance

What this is: This is an analysis of zero trust solutions, with the central finding that effective control must extend beyond login to post-authentication access, including credentials, tokens, keys, and privileged access paths.

Why it matters: It matters to IAM and NHI practitioners because standing permissions and long-lived secrets create the persistence attackers need, even when authentication itself is strong.

By the numbers:

• Credential abuse is still the most common way for a breach to start, accounting for roughly 22% of initial attack paths.
• Vulnerability exploitation accounts for 20% of initial attack paths.

👉 Read Apono's analysis of top zero trust solutions for production access

Context

Zero trust solutions are meant to remove the assumption that authenticated users or workloads should continue to be trusted after login. In practice, that means governance has to extend to IAM, PAM, secrets, APIs, and data systems, because standing permissions and long-lived credentials are where access risk usually persists.

For IAM and NHI practitioners, the core problem is not network location. It is whether access is continuously evaluated, narrowed to the task, and removed when the task ends. That makes zero trust a control model for identity and privilege, not just a perimeter strategy.

Key questions

Q: How should security teams implement zero trust for privileged access?

A: Start with the access paths that create the largest blast radius, then require policy checks at each request, not just at login. Use just-in-time elevation, automatic expiration, and full audit logging for privileged sessions. The goal is to make access temporary, scoped, and provable after the fact.

Q: Why do non-human identities complicate zero trust architecture?

A: Non-human identities often use reusable secrets, broad permissions, and unattended workflows, which makes them harder to review than human accounts. Zero trust fails if those identities are trusted by default or exempted from expiration, because the attacker then inherits durable machine-level access.

Q: What is the difference between zero trust and privileged access management?

A: Zero trust is the broader operating model that continuously verifies access decisions across systems. Privileged access management is one control layer inside that model, focused on high-risk access. PAM can support zero trust, but zero trust also has to cover secrets, APIs, endpoints, and non-human identities.

Q: When does just-in-time access reduce risk, and when does it not?

A: JIT access reduces risk when it replaces standing privilege, expires automatically, and is tied to a specific task. It does not reduce risk when long-lived secrets, weak approval rules, or broad default roles remain in place. Temporary access only helps if the surrounding trust model also shrinks.

Technical breakdown

Post-authentication enforcement in zero trust architectures

A zero trust architecture does not stop at authentication. It evaluates every access request against identity, policy, device state, and context, then enforces that decision at the point of use. That matters because a valid session can still become a liability if permissions remain standing after the original approval window. In NHI environments, the same logic applies to service accounts, tokens, and automation identities: authentication proves a subject exists, but authorization must still be constrained, time-bound, and auditable. When access is not enforced beyond login, the attacker’s job becomes simple reuse rather than exploitation.

Practical implication: Practitioners should treat login as the start of enforcement, not the end of it.

Standing permissions, JIT access, and privilege expiration

Standing permissions create durable access paths that survive the original business need. Just-in-time access changes that model by granting privileges only for a bounded task window and revoking them automatically afterward. The technical value is not only reduced exposure time, but also reduced ambiguity about who had access, when, and why. In cloud and engineering environments, this is especially important for database access, break-glass flows, and on-call work where temporary elevation is common. The failure mode is privilege creep, where a temporary approval becomes an indefinite entitlement.

Practical implication: Use JIT access as a default control for elevated and operational access paths.

Secrets management as a zero trust enforcement point

Secrets management is part of zero trust because credentials, tokens, and keys are the mechanism by which software proves identity. If those secrets are hardcoded, long-lived, or broadly reusable, the control model breaks even when policy logic is strong elsewhere. Effective enforcement therefore includes rotation, scoped issuance, and telemetry around use, not just storage. This is central to NHI governance because service accounts and automations often operate with the most persistence and the least human oversight. Zero trust fails when secrets remain valid longer than the access decision that justified them.

Practical implication: Tie secret lifetime and scope to the access decision that issued them.

Threat narrative

Attacker objective: The attacker aims to convert trusted identity into durable operational access and use that access to reach valuable internal resources without triggering obvious exploit-based alerts.

1. Entry occurs through abused credentials that already exist rather than through active exploitation of a new vulnerability.
2. Escalation follows when the stolen identity retains standing permissions or broad access across cloud, data, or application layers.
3. Impact comes from using legitimate access paths to move, read, or modify sensitive systems while blending into normal activity.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero trust for NHI governance is really about controlling access after authentication. Authentication answers who or what is requesting access. Governance fails when that answer is treated as sufficient, because standing permissions, reusable tokens, and broad roles still decide what can happen next. Practitioners should design for post-authentication enforcement, not just login assurance.

Standing privilege is the core governance gap in most zero trust programs. If access persists after the original task, the architecture is still carrying avoidable blast radius. JIT access, automatic revocation, and approval logging are not side features. They are the controls that turn zero trust from a slogan into an operational model.

Ephemeral credential trust debt is the hidden risk in modern engineering environments. Teams adopt temporary access patterns but often leave adjacent trust assumptions untouched, such as long-lived API keys, reusable secrets, and weak review of on-call elevation. Practitioners should measure whether temporary access is actually reducing the lifetime of privilege or just changing the request path.

Zero trust becomes more credible when it includes non-human identities. Service accounts, automation tokens, and workload credentials often have broader and longer-lived access than human users, yet receive less oversight. A control model that excludes NHIs only solves part of the problem, so governance must extend to secrets, workload identity, and machine privilege review.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
• Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
• For a broader control baseline, review OWASP NHI Top 10 to see how over-privilege, secrets, and agent misuse connect into one governance problem.

What this signals

Ephemeral credential trust debt: many programmes adopt temporary access controls without fully retiring the older trust assumptions that sit around them. That means the practical risk is not only whether access expires, but whether adjacent secrets, approvals, and machine identities still allow the same actions through another path. The governance answer is to measure the real privilege lifetime, not the ticket lifetime, and align the model with NIST SP 800-207 Zero Trust Architecture.

With 72% of organisations already reporting or suspecting NHI breaches, the operating assumption should be that machine identities are part of the attack surface, not an edge case, per The 2024 ESG Report: Managing Non-Human Identities. That changes programme priorities for access reviews, secret hygiene, and exception handling, especially where automation and on-call access intersect.

For practitioners, the next step is to connect policy design to enforceable controls at the resource layer, then validate that the policy is actually removing access rather than just documenting it. Zero trust only becomes operational when identity, privilege, and secret usage are measured together across human and non-human workloads.

For practitioners

• Map post-authentication access paths Inventory where permissions remain active after login, including cloud roles, database access, API keys, and service account credentials. Prioritise paths where a single identity can reach multiple systems without reapproval.
• Replace standing privilege with JIT approval Use just-in-time access for elevated tasks, then revoke permissions automatically when the task ends. Require approval context, expiration, and audit logging for each request, especially for on-call and break-glass scenarios.
• Treat secrets as governed identities Track credentials, tokens, and certificates with the same discipline you apply to human access. Scope issuance, reduce lifetime, and review which systems can still authenticate with old secrets.
• Add NHI visibility to zero trust reviews Include service accounts, workloads, and automation in access reviews so non-human identities do not become the exception path. Reconcile privilege changes with actual usage, not with ticket history alone.

Key takeaways

• Zero trust programs fail when authentication is treated as the control boundary and standing access remains untouched.
• Credential abuse remains a dominant breach path because attackers often reuse valid access instead of exploiting new flaws.
• The practical response is to make human and non-human access temporary, policy-scoped, and auditable across every enforcement point.

Key terms

• Standing Privilege: Standing privilege is access that remains available after the original need has ended. In NHI governance, it is one of the most common sources of unnecessary blast radius because the credential or role stays valid long after the task, approval, or engineering session is finished.
• Just-in-Time Access: Just-in-time access is a control pattern that grants permissions only for a specific task and a limited time window. It is used to reduce persistent exposure by making elevated access expire automatically and by tying each request to an approval and audit trail.
• Non-Human Identity: A non-human identity is any machine-based actor that authenticates to systems, including service accounts, API keys, tokens, certificates, bots, workloads, and AI agents. These identities often outnumber humans and can be harder to govern because they operate continuously and at machine speed.
• Post-Authentication Enforcement: Post-authentication enforcement means access is checked again after login, at the point where a request reaches a resource or action. It matters in zero trust because identity proof alone does not prevent misuse when permissions, secrets, or sessions remain overly broad.

Deepen your knowledge

Zero trust access governance and non-human identity control are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are trying to replace standing privilege with provable access control, it is worth exploring.

This post draws on content published by Apono: Top 10 Zero Trust Solutions. Read the original.