Topic starter
25/06/2026 3:14 pm
TL;DR: Standing privileged access and manual approval workflows no longer match the pace of cloud and SaaS administration, so just-in-time privileged access is increasingly used to reduce lingering rights, improve auditability, and limit exposure, according to SecurEnds. The deeper issue is that static PAM assumes privileged access will remain in place long enough to be governed, which modern access patterns no longer guarantee.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Why Traditional PAM Falls Short—and How JIT Access Solves It”.
Key questions
Q: What breaks when privileged access is not continuously governed?
A: When privileged access is not continuously governed, standing privilege persists, dormant accounts remain usable, and the attack surface expands across human and machine identities.
Q: When does just-in-time access reduce cloud risk?
A: Just-in-time access reduces cloud risk when standing privilege is the main problem and the baseline permissions are already tightly scoped.
Q: What do security teams get wrong about PAM deployment choices?
A: Teams often treat PAM as a technology preference instead of an operating model decision.
Practitioner guidance
- Audit standing privileged accounts List every elevated account across cloud consoles, SaaS admin panels and on-prem systems, then identify where access remains active after the original task ends.
- Replace ticket queues with bounded requests Define request, approval and expiry rules so elevated access is granted for a specific purpose and removed automatically when the window closes.
- Inventory SaaS and cloud admin roles Map the privileged roles that legacy PAM cannot reliably see, then decide which ones need JIT workflows and which require stricter emergency access handling.
Bottom line: Standing privileged access becomes a governance problem when elevated rights remain active after the work that justified them has ended.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:39 pm
Standing privilege is the control failure, not just the symptom. Static PAM assumes elevated access can remain in place long enough to be governed through vaulting, approval and periodic review. In cloud and SaaS operations, that assumption collapses because work is shorter-lived than the entitlement. The practitioner conclusion is that privilege duration must be treated as a first-class control variable, not an afterthought.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams compare standing admin rights and just-in-time privilege?
A: Standing admin rights are persistent authority, while just-in-time privilege is temporary authority issued for a specific task. The difference matters because persistent access creates a standing attack surface, whereas JIT makes the access lifecycle part of the control. For modern IAM, that is a governance decision, not a cosmetic one.
👉 Read our full editorial: Just-in-time privileged access is replacing standing admin rights