Does JIT solve NHI risk, or just shorten the attack window?

TL;DR: Just-in-time access reduces the lifetime of a credential, but it does not remove the trust assumptions behind the non-human identity requesting it, according to Entro Security. For IAM and NHI programmes, the real control problem is not expiration speed but whether the issuer, workload, or automation path can be trusted at request time.

Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “Ephemeral Isn’t Enough: The JIT Paradox and Zero Trust for NHIs”.

Key questions

Q: When does just-in-time access fail as an NHI control?

A: Just-in-time access fails when the standing privilege underneath it remains broad, poorly owned, or rarely reviewed.

Q: When does ephemeral access still create zero-trust risk for NHIs?

A: It creates risk whenever the organisation trusts the identity that mints the access more than the access itself.

Q: What are the signs that JIT access is not being enforced effectively?

A: Common signs include over-reliance on visibility tools, manual triage for risky identities, and policies that can issue privilege but cannot safely deny it when behaviour changes.

Practitioner guidance

• Audit access issuers, not just credentials Map every broker, workload identity system, CI/CD runner, token service, and cloud IAM policy that can mint JIT access.
• Baseline requester behaviour for each NHI Define normal issuer activity, consumer usage, and sensitive operations for service accounts and automation paths.
• Add context-aware deny logic Use targeted enforcement that blocks risky NHI behaviour when an identity crosses a meaningful threshold, rather than relying on broad revocation or manual triage after the fact.

Bottom line: JIT reduces the time a credential can be abused, but it does not by itself remove the trust decision behind the identity that requests the credential.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →