Notifications
Clear all
Topic starter
09/07/2026 1:41 pm
TL;DR: Least privilege remains difficult to enforce at scale because many organisations still lack visibility into service accounts, machine identities, APIs, and AI agents, while manual access reviews continue to rubber-stamp excessive permissions, according to SailPoint. The practical shift is toward discovery, contextual governance, and just-in-time access, because standing privilege is the control failure that keeps the attack surface open.
NHIMG editorial — based on content published by SailPoint: Beyond the buzzword: 3 practical steps to achieve least privilege today
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams implement just-in-time access for privileged identities?
A: Start with the highest-risk roles, such as domain administrators, production operators, and service accounts with broad write access.
Q: Why does standing privilege increase risk across humans and non-human identities?
A: Standing privilege keeps elevated access available when it is no longer needed, which expands the window for misuse, theft, and accidental overreach.
Q: What do security teams get wrong about least privilege in cloud environments?
A: They often treat least privilege as a one-time entitlement exercise instead of a lifecycle problem.
Practitioner guidance
- Inventory all privileged identities across the environment Discover humans, service accounts, machine identities, APIs, and AI agents in one governed inventory, then assign a real owner and business purpose to each identity so no privileged account remains anonymous.
- Convert persistent elevation into time-bound access Move high-risk administrative roles into just-in-time workflows that grant access only for the task window, then automatically revoke it when the session ends.
- Use context to right-size entitlements Enrich access reviews with usage data, privilege sensitivity, and anomaly signals so reviewers can remove permissions that are never used or are clearly out of scope.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance for discovering non-human identities across hybrid and multi-cloud environments.
- Examples of how to enrich access decisions with AI-driven context for risky or anomalous permissions.
- A practical JIT workflow pattern for requesting, approving, and revoking elevated access.
- Operational guidance on logging and monitoring privileged sessions for auditability.
👉 Read SailPoint's blog on practical least privilege steps for humans and NHIs →
NHI least privilege gaps: are visibility and JIT enough today?
Explore further
09/07/2026 1:46 pm
Least privilege has become an identity governance problem, not a policy slogan. The article is right to treat standing privilege as the main failure mode, because the risk is created when permissions outlive the task they were meant to support. In modern environments, that applies equally to humans, workloads, and AI-adjacent automation. The practitioner takeaway is simple: if privilege is not time-scoped and ownership-backed, it is not least privilege in operational terms.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how far most programmes still are from complete NHI governance.
A question worth separating out:
Q: How do IAM and PAM teams decide whether JIT access is needed?
A: Use JIT when the role is powerful, the task is short, and persistent elevation cannot be justified by business need. If the identity only requires elevated access occasionally, permanent privilege is usually the wrong default. The decision should be based on task duration, blast radius, and the quality of your audit trail.
👉 Read our full editorial: Least privilege for NHIs now depends on visibility and JIT
