Topic starter
24/06/2026 11:57 pm
TL;DR: Standing privileges, hardcoded tokens, and slow approval loops keep expanding attack paths in cloud-native environments, while 58% of security leaders expect identities to grow further in the next year, according to Apono’s analysis. JIT PAM matters because access review assumes privilege lasts long enough to be governed; in practice, it often persists until it is already abused.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “7 Tips for Just-in-Time Privileged Access Management You Need to Implement Today”.
By the numbers:
- 58% of security leaders expect the number of identities, human and non-human, to grow in the next year.
- Non-human identities now outnumber human ones by more than 80 to 1 in modern environments.
Key questions
Q: What breaks when standing privileges are left in place for cloud infrastructure changes?
A: Standing privileges increase the chance that a routine change can affect shared systems far beyond the intended task.
Q: Why do long-lived permissions create more risk than rotation alone removes?
A: Long-lived permissions matter because the underlying entitlement remains usable even when individual secrets are rotated.
Q: How do IAM and PAM teams know whether JIT is actually working?
A: Look for shorter approval times, fewer unnecessary escalations, lower approval fatigue, and a smaller number of broadly pre-approved access paths.
Practitioner guidance
- Audit and remove standing privilege Run a full privilege inventory across human and non-human accounts, then replace persistent roles with time-bound access policies that expire automatically when the task ends.
- Automate request and approval flows Use contextual triggers so that access requests open an ephemeral credential or federated role without forcing teams into ticket-based workarounds that encourage privilege creep.
- Apply JIT controls to CI/CD and production access Scope build, deployment, and emergency access to the exact resource and duration required, then revoke it automatically once the session closes.
Bottom line: Standing access is the governance failure that JIT PAM is designed to eliminate in cloud-native environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:46 am
Access review assumptions break once privilege is meant to be temporary by default. JIT PAM is not a faster approval workflow, it is a different governance premise. Traditional recertification assumes access persists long enough to be inspected; JIT makes the relevant control event the grant and expiry themselves. The practitioner conclusion is that review cadences alone cannot govern environments built on ephemeral access.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 49% of IT professionals would prioritise improving privileged access management if the decision were theirs alone, according to Netwrix's 2023 Hybrid Security Trends Report.
A question worth separating out:
Q: How should organisations govern non-human identities alongside employee access?
A: Organisations should govern NHIs with the same discipline used for human access, but with stronger lifecycle ownership and expiry controls. That means inventorying service accounts, tokens, certificates, and agents, assigning business ownership, and tying every entitlement to a documented purpose. Governance is incomplete if machine access cannot be approved, certified, and removed on demand.
👉 Read our full editorial: Just-in-time privileged access is the fix for access drift