Topic starter
25/06/2026 12:40 am
TL;DR: DevOps pipelines increase the spread of API keys, tokens, and admin credentials, and static PAM models often struggle to keep pace with cloud-native delivery, according to SSH Communications Security. The real issue is not speed alone but whether access can be governed, audited, and removed fast enough to avoid standing privilege and credential sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by SSH Communications Security: “What Makes a PAM Solution a Good Fit for DevOps?”.
Key questions
Q: What breaks when developers share privileged credentials across DevOps teams?
A: When developers share privileged credentials, identity attribution breaks down and teams lose visibility into who performed which action and under what rights.
Q: Why do ephemeral credentials reduce DevOps risk?
A: Ephemeral credentials reduce risk because they narrow the window in which a secret can be stolen, reused, or shared.
Q: What are the signs that PAM controls are failing in a DevSecOps pipeline?
A: Common warning signs include scattered credentials, active secrets that were never rotated, broad access granted to developers or automated processes, and logs that do not show who accessed what and when.
Practitioner guidance
- Map privileged access by execution context Inventory which credentials are used by pipelines, containers, operators, and cloud workloads, then classify which ones can be replaced with ephemeral access or programmatic issuance.
- Replace standing secrets with short-lived issuance Use dynamic injection, expiry, and automated de-provisioning for API keys, tokens, and admin credentials so long-lived secrets do not become the normal operating state.
- Tie privileged access to CI/CD and cloud runtimes Integrate PAM with Kubernetes, GitHub Actions, GitLab, Azure DevOps, and cloud IAM so access requests and revocation happen inside the delivery workflow.
Bottom line: DevOps delivery creates a privileged access problem because secrets, tokens, and admin credentials move at automation speed rather than human review speed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:38 am
DevOps PAM is really a secrets-lifecycle problem, not a vault problem: The hard part is not storing credentials, it is governing when they exist, who can fetch them, and how quickly they disappear after use. Static PAM models were built around durable accounts and predictable administration windows, which is a poor fit for CI/CD and ephemeral execution. The practitioner conclusion is that secrets governance has to start at issuance time, not after access is already in circulation.
A few things that frame the scale:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
Q: How should security teams govern credentials used by CI/CD pipelines?
A: Security teams should treat CI/CD credentials as production-grade machine identities and apply least privilege, short lifetimes, and continuous monitoring. The key is to limit what the pipeline can reach, revoke secrets quickly, and audit every privilege path that could let one stolen token spread across repositories, cloud accounts, or SaaS systems.
👉 Read our full editorial: DevOps PAM for ephemeral access and secrets governance