Notifications
Clear all
Topic starter
02/09/2026 1:29 pm
TL;DR: Just in time access reduces standing permissions and narrows exposure, but Ploy argues that it only works when organisations first gain visibility into current access, define clean policies, and integrate enforcement with existing IAM and audit workflows. The deeper issue is that static role models and access creep assume privilege is stable enough to review later, which is increasingly false.
NHIMG editorial — based on content published by Ploy: Just in Time Access: Revolutionizing Cybersecurity in a Dynamic World
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should security teams implement just-in-time access without creating too much friction?
A: Start with the systems that carry the highest business or data risk, then make the request path consistent and predictable.
Q: Why do just-in-time permissions not eliminate standing privilege risk?
A: Because they control duration, not entitlement quality.
Q: What breaks when access reviews are used as the main risk control?
A: Access reviews break down when they are treated as the primary control instead of a validation step.
Practitioner guidance
- Map standing privilege before piloting JIT Inventory which users, service accounts, and workflows retain broad access beyond the task that created it.
- Rationalise roles before tightening elevation rules Clean up overlapping roles, stale entitlements, and exceptions that would otherwise be reissued on demand.
- Validate revocation across every downstream system Test whether privilege removal propagates to cloud consoles, SaaS apps, and session-backed tools with no lingering access tokens.
What's in the full article
Ploy's full insights piece covers the operational detail this post intentionally leaves for the source:
- The article expands on how JIT fits into broader IAM architecture, including where RBAC should still anchor access design.
- It walks through the practical challenges of integrating dynamic access with existing cloud and on-premise workflows.
- It gives a fuller discussion of implementation hurdles, including legacy systems, employee resistance, and rollout sequencing.
- It explains how continuous monitoring and policy tuning support ongoing JIT governance after initial deployment.
👉 Read Ploy's analysis of just in time access and static IAM limits →
Just in time access: are static IAM controls keeping up?
Explore further
02/09/2026 1:30 pm
JIT access is a control over duration, not a substitute for identity hygiene. Temporary permissions reduce the blast radius of standing privilege, but they do not fix poor role design, weak visibility, or unmanaged exceptions. That means the control is only as strong as the baseline IAM and PAM programme beneath it. Practitioners should treat it as a containment layer, not a repair mechanism.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: What should teams do immediately if revocation is not consistent across systems?
A: Suspend scale-up and fix the propagation gap before expanding JIT. If access removal does not reach every console, application, and token consumer, the programme creates temporary approvals but persistent exposure. Focus first on the systems where revoked privilege still remains active after the business task ends.
👉 Read our full editorial: Just in time access exposes the limits of static IAM models
