Does JIT solve NHI risk, or just shorten the attack window?

TL;DR: Just-in-time access reduces the lifetime of a credential, but it does not remove the trust assumptions behind the non-human identity requesting it, according to Entro Security. For IAM and NHI programmes, the real control problem is not expiration speed but whether the issuer, workload, or automation path can be trusted at request time.

NHIMG editorial — based on research published by Entro Security.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: How should security teams govern just-in-time access for non-human identities?

A: Security teams should treat JIT as a timing control, not a trust control.

Q: Why does ephemeral access still create risk for NHI programmes?

A: Ephemeral access still creates risk because the mechanism that issues it can be compromised.

Q: What is the difference between JIT access and Zero Trust for NHIs?

A: JIT shortens the duration of privilege, while Zero Trust for NHIs validates whether the requesting identity should receive privilege in the first place.

Practitioner guidance

• Inventory every identity that can mint privilege Map brokers, pipeline runners, workload identities, and token services that can issue fresh access so you can see where standing trust still exists.
• Apply contextual approval to JIT grants Require behavioural baselines, consumer checks, and resource sensitivity thresholds before issuing temporary access.
• Constrain the blast radius of issuers Limit which systems each brokered identity can affect, then test deny rules in production-safe ways before broad rollout.

The next phase of programme maturity is to align access issuance with behavioural context, lifecycle state, and explicit policy thresholds so that temporary privilege cannot be minted from untrusted conditions?

👉 Read Entro Security's analysis of the JIT paradox and NHI Zero Trust →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →