Topic starter
25/06/2026 3:13 pm
TL;DR: Always-on admin access keeps standing privilege alive long after a task ends, expanding attack and audit risk, according to SecurEnds. Just in time access narrows that exposure window, but the real security gain comes from replacing persistent entitlement with tightly governed, task-scoped elevation.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Just-in-Time Access for Admins: A Smarter Way to Reduce Risk”.
By the numbers:
- Gartner says 70% of cloud breaches involve overprivileged accounts.
- Access is approved for 30 minutes, an hour, or whatever the policy allows before it automatically disappears.
Key questions
Q: What is the first step in reducing risk from always-on admin access?
A: Start by identifying which privileged accounts stay active outside a task window and rank them by system reach and business criticality.
Q: How should security teams govern privileged access in cloud and hybrid environments?
A: Teams should govern privileged access around runtime authorization, not just connectivity or login.
Q: What breaks when privileged access is not continuously governed?
A: When privileged access is not continuously governed, standing privilege persists, dormant accounts remain usable, and the attack surface expands across human and machine identities.
Practitioner guidance
- Map standing admin rights first Inventory which admin and superuser accounts remain active outside a task window, then rank them by blast radius, system reach, and business criticality.
- Replace persistent elevation with task-scoped approval Require a request, approval, and automatic expiry for privileged sessions tied to patching, troubleshooting, contractor work, or other defined tasks.
- Bind privileged access to policy triggers Use maintenance windows, ticket references, and context checks to decide when elevation can be issued and when it must shut off.
Bottom line: The article argues that the core risk is standing admin privilege that remains active long after a task ends, not admin access in the abstract.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:37 pm
Standing privilege is the real blast-radius problem, not admin convenience. The article correctly frames persistent elevation as the condition that turns one compromised credential into enterprise-wide exposure. In PAM terms, the issue is not admin access itself but access that outlives the task and survives beyond the point of accountability. Practitioners should treat privilege duration as a first-class control variable.
A few things that frame the scale:
- 91% of organisations say at least half of their privileged access is always-on, and only 1% have fully implemented just-in-time privileged access, according to a CyberArk study.
A question worth separating out:
Q: What is the difference between just-in-time access and standing privilege?
A: Just-in-time access grants privilege only for a defined task window, while standing privilege remains active until someone removes it. JIT reduces exposure by shrinking the time an identity can be abused, but standing privilege creates a constant attack surface. For NHI programs, the difference is often the difference between contained risk and persistent exposure.
👉 Read our full editorial: Just in time access reduces admin blast radius in modern PAM