Topic starter
08/04/2026 9:27 pm
TL;DR: Teleport says static credentials, standing privileges, and fragmented access paths still push engineers toward insecure workarounds even when teams try to reduce access friction in infrastructure environments. The control problem is not speed alone but whether identity governance can remove persistent secrets and preserve auditability.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “Recap: Experience Frictionless Access Without Sacrificing Security”.
By the numbers:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
Key questions
Q: What breaks when organisations rely on static credentials instead of temporary elevated access?
A: Static credentials tend to outlive the task, the user, and sometimes the control that issued them.
Q: Why do standing privileges increase risk in engineering environments?
A: Standing privileges keep administrative access available all the time, which enlarges blast radius and weakens accountability.
Q: How can security teams reduce friction without weakening privileged access controls?
A: Reduce friction by centralizing policy, shortening approval paths for low-risk tasks, and automating credential expiry and revocation.
Practitioner guidance
- Replace static credentials with short-lived access paths Eliminate locally stored API keys, SSH keys, and passwords for infrastructure work and issue access only for the task in progress.
- Convert standing privilege into task-scoped elevation Limit administrative reach to the specific resource and time window needed for the job, then revoke it automatically after use.
- Retire VPN dependence for resource access Move from perimeter tunnels to identity-based access that binds each session to authenticated identity and private resources.
Bottom line: Static credentials and standing privileges create the very friction they are supposed to remove, because teams respond to delays by bypassing formal access paths.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- Webinar discussion on why approval delays drive engineers toward insecure workarounds
- Practical examples of replacing passwords, API keys, and SSH keys with identity-bound access
- Session-level controls for granular role assignment and automatic expiry
- The access model used to replace VPN dependence with private, identity-based routing
👉 Read Teleport's analysis of frictionless infrastructure access and identity controls →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
07/10/2026 9:24 pm
Standing privilege is the governance assumption that access can exist before the task begins. That assumption breaks when infrastructure work is urgent, distributed, and multi-cloud, because access becomes a permanent state instead of a temporary need. The result is not just excess privilege but a programme that certifies the wrong thing. Practitioner conclusion: identity governance has to measure privilege duration, not only privilege level.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do IAM teams know whether access governance is working?
A: IAM teams should look for fast revocation after role change or departure, accurate entitlement data, and low numbers of orphaned or over-provisioned accounts. If access creation is easy but removal is slow, governance is incomplete. The strongest signal is whether access still matches business need after the identity changes.
👉 Read our full editorial: Frictionless infrastructure access still depends on stronger identity controls